last command

manoj.linux · 06-10-2008, 09:25 AM

Hi,

I am getting login attempts of users for 15 days only using last command , is there any way I want login attempts of 2 months?

Regards,

Manoj

colucix · 06-10-2008, 09:44 AM

The last command shows the last login attempts based on the content of /var/log/wtmp. If the file is log rotated, you can select an older file using the -f option. How many wtmp files are kept on your system, depends on the logrotate rules.

manoj.linux · 06-12-2008, 12:07 AM

Quote:

Originally Posted by colucix

The last command shows the last login attempts based on the content of /var/log/wtmp. If the file is log rotated, you can select an older file using the -f option. How many wtmp files are kept on your system, depends on the logrotate rules.

Thanks for quick reply, But can we increase the time limit for example if it is showing 15 days data can we increase upto 1 Month.

Regards,

Manoj

colucix · 06-12-2008, 02:22 AM

It still depends on the content of the /var/log/wtmp file. You can reduce the number of shown entries using the -n option, but if the data are splitted in different files you have to use the -f option. You can read from multiple files with one command

Code:

last -f /var/log/wtmp -f /var/log/wtmp.1

but if you want to extract a specific period of time, for example exactly one month before, you have to parse the output of the above through scripting.