CODEWITHSUNDEEP
linux
Rob
Rob

Reputation: 11

Linux ssh last - show last logged in past 10 days

How to see last logged via SSH with "last" command? I mean the last 10 days. It shows for me only last two days even if I use last -n 1000

Or maybe my logs contain only last two days so how eventually check that and increase this value?

Upvotes: 1

Views: 1687

Answers (2)

jbrahy
jbrahy

Reputation: 4415

You'll need to check /etc/logrotate.conf Here's the relevant portion of one of my servers.

/var/log/wtmp {
    monthly
    create 0664 root utmp
        minsize 1M
    rotate 1
}

if your server is rotating files out and you want to look at what was in the previous month then use the last -f command.

ls /var/log/wtmp*
last -f /var/log/wtmp-20140902 (or whatever the filename is to examine)

log rotation and renaming are distribution dependent. (thanks David C. Rankin)

lastly (no pun intended) you can always do a

man last

and get all the potential command line switches.

Upvotes: 4

Leonel Folmer
Leonel Folmer

Reputation: 211

The information of who logged in when is available in /var/log/auth.log (or other log files on other distributions). There are multiple log monitoring programs that can extract the information you configure as relevant. On any sane system, every user authentication is logged.

If the accounting subsystem is up and running, then lastcomm shows information about finished processes.

Upvotes: 0

Related Questions