Need Wtmp Reader Post: 539

Sponsored Content

Top Forums UNIX for Dummies Questions & Answers Need Wtmp Reader Post 539 by Neo on Wednesday 13th of December 2000 02:23:20 AM

12-13-2000

Administrator

last(1)

The last(1) command reads wtmp. If you want super-details, you can get the source code for last(1) and examine the format details. If you want to read wtmp in a standard way, just use last.

Also, you can do a man on both last and wmtp to get high level, general details.

Quote:

Last looks back in the wtmp file which records all logins and logouts for information about a user, a teletype or any group of users and teletypes. Arguments specify names of users or teletypes of interest. If multiple arguments are given, the information which applies to any of the arguments is printed. For example ``last root console'' would list all of root's sessions as well as all sessions on the console terminal. Last displays the sessions of the specified users and teletypes, most recent first, indicating the times at which the session began, the duration of the session, and the teletype which the session cut short by a reboot, last so indicates.

The pseudo-user reboot logs in at reboots of the system.

Last with no arguments displays a record of all logins and logouts, in reverse order.

If last is interrupted, it indicates how far the search has progressed in wtmp. If interrupted with a quit signal last indicates how far the search has progressed so far, and the search continues.

[Edited by Neo on 12-13-2000 at 02:33 AM]

Neo

View Public Profile for Neo

Visit Neo's homepage!

Find all posts by Neo

9 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

manage the wtmp file

Here's a usefull perl script to trim the wtmp file, in case it got too big, which happens sometimes, or got curropted (which also happens often). You could learn from here how to parse the wtmp file... but of course for just reading its content always simply use "last" like Neo said.... ...

2. UNIX for Dummies Questions & Answers

Resetting WTMP?

When I type last oracle I get dates from Nov 28, 2000 all the way back to the beginning of time it seems. The 11-28-2000 entry states that Oracle is still logged in, but if you type a who, it shows only 1 entry - the currently logged in user (Me as oracle), but I logged in only minutes ago - and...

3. UNIX for Dummies Questions & Answers

wtmp

Hi, is it ok if i delete wtmp on HPUX 11 under /var/adm It is filling up that filesystem Cheers

4. UNIX for Dummies Questions & Answers

truncate wtmp

I have AIX5.1 I have been trying to learn how to truncate the /var/adm/wtmp file. I have seen several things on google actually but don't quite understand. I also searched your forums but couldn't find it. one says this ">/var/adm/wtmp Is that all I do? I have a seperate question also. I was...

5. Red Hat

changing wtmp ownership and permission

Hi, I am using redhat AS 3. Recently, I was asked to implement a security control on the OS: to change ownership of /var/log/wtmp to root:sys and permission to 600. However, when I made the change and reboot the machine, everything was reverted. How come? Please help. The following is the...

6. AIX

wtmp file

Hello everyone I have a problem with the file wtmp that is on /var/adm This file was not on this directory (adm). I try creating a new file with the correct rights (644) and owner (adm:adm) but It doesnt work. If I type the last command i get this last ora10g ...

7. AIX

Clear wtmp

Hello, Is there a difference between the following commands besides consider the file permissions? /usr/sbin/acct/nulladm /var/adm/wtmp >/var/adm/wtmp cat /dev/null >/var/adm/wtmp Today I tried the second command and it worked...

8. Red Hat

wtmp output

Hi, Can anybody explain wtmp output fields? A dir was created at 7:11pm and I wanted to find out who was logged in at that time but as you can see there is no ip address listed when I run utmpdump against the wtmp file..... R, D.

9. AIX

Wtmp empty everyday

Anyone got experience where wtmp logs get truncated everyday? Though sulog, failedlogin and lastlog seems to be fine. The server uptime is 18 days running on AIX 5.3. Sorry this seems to be a generic questions but never really encountered before.

LEARN ABOUT SUNOS

last

last(1) 							   User Commands							   last(1)

NAME

       last - display login and logout information about users and terminals

SYNOPSIS

       last [-a] [-n number | -number]	[-f filename] [name | tty] ...

DESCRIPTION

       The  last  command looks in the /var/adm/wtmpx file, which records all logins and logouts, for information about a user, a terminal, or any
       group of users and terminals. Arguments specify names of users or terminals of interest. If multiple arguments are given,  the  information
       applicable  to any of the arguments is printed. For example, last root console lists all of root's sessions, as well as all sessions on the
       console terminal. last displays the sessions of the specified users and terminals, most recent first, indicating the  times  at	which  the
       session	began,	the  duration of the session, and the terminal on which the session took place. last also indicates whether the session is
       continuing or was cut short by a reboot.

       The pseudo-user reboot logs in when the system is shutdown and when it reboots. Thus,

       last reboot

       gives an approximate record of when the operating system instance was shutdown and when it rebooted. This can  be  used	to  calculate  the
       availability of the operating system over time.

       last with no arguments displays a record of all logins and logouts, in reverse order.

       If last is interrupted, it indicates how far the search has progressed in /var/adm/wtmpx. If interrupted with a quit signal (generated by a
       CTRL-), last indicates how far the search has progressed, and then continues the search.

OPTIONS

       The following options are supported:

       -a			       Displays the hostname in the last column.

       -f filename		       Uses filename as the name of the accounting file instead of /var/adm/wtmpx.

       -n number|-number	       Limits the number of entries displayed to that specified by number. These options are identical; the  -num-
				       ber option is provided as a transition tool only and is removed in future releases.

ENVIRONMENT VARIABLES

       Date and time format is based on locale specified by the LC_ALL, LC_TIME, or LANG environments, in that order of priority.

FILES

       /var/adm/wtmpx	       accounting file

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE	     |	    ATTRIBUTE VALUE	   |
       +-----------------------------+-----------------------------+
       |Availability		     |SUNWesu			   |
       +-----------------------------+-----------------------------+

SEE ALSO

       utmpx(4), attributes(5)

SunOS 5.10							    24 Jul 2004 							   last(1)