Hello,

I want to display logins after a especific date. The -t switch of the last command gives me the opposite, i.e, it gives the logins till that date. Any idea how I can approach this?

Thanks.

I think you need a script to filter the dates that are greater than the data you specify. I can't see any cmd-line trick to do that.

The best language to do this is perl. It has functions to handle dates and times, so you can compare dates easily.

Now I have a problem... the last command doesn't show the year.

Note: I will call to the Linux command last as last()

I am checking the remote root logins and keeping the last occurrence in a file. When I want to check for new occurrences I run last() filtered with root and non-local address and compare the date with the last occurence in the file. I am comparing month, day and time but if the last() gives me occurrences from the past year, I will go into trouble... .
I think that wtmp is "logrotating" (I don't now if it is by time or size) so I hope it will not contain entries from the past year.

Any ideas or thoughts about this?

Thanks.

Depends on the distro, in slack it's once a month.
You could check your /etc/cron.* directories, /etc/crontab (if
it exists) and for root crontab -l ...


Cheers,
Tink

"last -F" should display the year.
That is it does here.

(Did you notice the rhyme? Is there a subforum for advanced poetry?)

You could probably extract the date from last and convert it to seconds since epoch using the "date" command. Then retrieving the logins that occured since a specified date will reduce to a simple numerical comparison.

For instance, in my Debian Sarge the -F switch doesn't exist...

What a shame. Then this might be of interest: http://www.itworld.com/Comp/1375/nls...331/index.html