"Last login: " Where is it stored?

phsythax · 04-25-2007, 03:22 AM

Where is the "last login" variable stored? it appears when logging in on a local terminal or threw ssh remotely.

Nathanael · 04-25-2007, 04:04 AM

on my debian system the command /urs/bin/lastlog does the trick for me, though it does not tell me where it is stored, only shows the details for each user

SlackDaemon · 04-25-2007, 05:27 AM

These are usually logged in:

/var/log/wtmp
/var/log/utmp
/var/log/lastlog

The location could be different depending on the distro. These are data files so you can only view the results with the last and
lastlog commands

edit: these files are also used by the w and who commands

win32sux · 04-25-2007, 12:30 PM

you can use strace to see where your particular distro looks...

for example, check last like:

Code:

strace last

you should see lines like this within the output:

Code:

open("/var/log/wtmp", O_RDONLY)         = 3
open("/etc/localtime", O_RDONLY)        = 4

phsythax · 04-29-2007, 08:13 AM

Quote:

Originally Posted by win32sux

you can use strace to see where your particular distro looks...

for example, check last like:

Code:

strace last

you should see lines like this within the output:

Code:

open("/var/log/wtmp", O_RDONLY)         = 3
open("/etc/localtime", O_RDONLY)        = 4

Okey, Thanks everyone!