I am trying to figure out times of logins into my systems (basically systems boot).
I am making use of last
Unix command. However, it does not let me pull more than a certain number of entries. I assume that the log file from which it pulls, which is /var/log/wtmp
, gets overwritten after a certain size.
I see that i have a wtmp.1
file also, so using -f
parameter i can go back a month further back the logs using this parameter. Wondering if logs further back are archived somewhere.
So, my question is: Is there a way to get older entries.
The following is the last
call that i am making:
last -n 10000|grep "system"
Here are last few lines of the output
reboot system boot 3.5.0-36-generic Sun Jul 7 07:07 - 22:08 (15:01)
reboot system boot 3.5.0-36-generic Sat Jul 6 23:23 - 23:23 (00:00)
reboot system boot 3.5.0-34-generic Sat Jul 6 09:40 - 23:22 (13:42)
reboot system boot 3.5.0-34-generic Sat Jul 6 09:38 - 09:39 (00:00)
reboot system boot 3.5.0-34-generic Sat Jul 6 06:40 - 09:39 (02:58)
reboot system boot 3.5.0-34-generic Sat Jul 6 06:15 - 06:17 (00:02)
reboot system boot 3.5.0-34-generic Sat Jul 6 06:13 - 06:17 (00:03)
reboot system boot 3.5.0-34-generic Fri Jul 5 19:30 - 22:34 (03:03)
I am not able to get logs further back in time.
-n 10000
or -n 1000000
, i get the same output.Eventually i will write a quick Python script to parse this o/p from subprocess module.
EDIT : Most of the answers below are correct. Unfortunately could accept only one answer. The logs once gone are gone!
you don't say what type of unix / linux you are running but on my Ubuntu hosts this works good for last boot times
for f in /var/log/wtmp*; do last -f $f reboot;done
All it does is find all the wtmp files in /var/log and then filter out the reboot user
last searches back through the file /var/log/wtmp. So regarding 2) it can only list those entries contained in wtmp. (use parameter f to specify any other file) E.g. if you rotate that file with a log rotator, it won't see those entries per default. 1) depends ;-)
You can only list those logins for which the log (resp. the rotate log are still present)
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With