record of user sessions

PirateJack · 04-03-2006, 05:39 AM

Using RH enterprise 2.1, I want to view who logged in on a certain date.
Anyone know if this is possible?

gilead · 04-03-2006, 06:15 AM

Have a look at the last command - it should do what you want.

PirateJack · 04-03-2006, 06:33 AM

It seems the logfile /var/logs/wtmp is only created the first time you use the last command though, and that is the first time the command has been used it seems!

gilead · 04-03-2006, 06:42 AM

It can also be created manually with the touch command - some distros do this as part of the install.

PirateJack · 04-03-2006, 06:47 AM

So it would be good practice to use the last command to create the log file after installation?

gilead · 04-03-2006, 02:25 PM

Yes it would. You can also create lastb as a symbolic link to last and track bad logging attempts. Where last uses /var/log/wtmp (or the -f option to change the file), lastb uses /var/log/btmp.