As you know, the last
command reads the list of logins from the /var/log/wtmp file. Alternatively, one can specify another file using the -f option.
On my Debian Wheezy box I see 2 files, wtmp and wmtp.1 inside /var/log:
gacanepa@debian:~$ ls -lh /var/log | grep wtmp
-rw-rw-r-- 1 root utmp 1.2M Oct 1 19:49 wtmp
-rw-rw-r-- 1 root utmp 783K May 23 17:23 wtmp.1
The wtmp file contains the logins information from May 24th, 2013, up to today (October 1st, 2013), while the wtmp.1 contains the same information from May 23rd down to the date when I installed the system.
On another Linux box (Mint 14):
- wtmp.1: from Sep. 1st to Sep. 30th
- wtmp: starts on Oct. 1st (Today)
On yet another Linux box (CentOS 7):
- Only wtmp: starts on the date when I installed the OS (April 2013) up to today.
So the question is, is there a way to customize the start and end dates of wtmp and when all of the logins information will be copied to wtmp.1?
In the Mint example, I installed that machine in late March of this year, but only the logins from Sep. 1 through Oct. 1 are available (considering both files). What if I want to see the logins prior to Sep. 1? Is that information lost?