# # (SCO Unix) I need information from 'last', but most of it is gone!
APLawrence.com -  Resources for Unix and Linux Systems, Bloggers and the self-employed

I need information from "last", but most of it is gone! (Old Sco Unix)

I've removed advertising from most of this site and will eventually clean up the few pages where it remains.

While not terribly expensive to maintain, this does cost me something. If I don't get enough donations to cover that expense, I will be shutting the site down in early 2020.

If you found something useful today, please consider a small donation.



Some material is very old and may be incorrect today

© December 2003 (various)

(SCO) The default root crontab cleans out /usr/adm/sulog, /etc/wtmp and /etc/wtmpx on Sunday mornings. The script that does this is /etc/cleanup.

(Linux) Logrotate does the cleaning, so modify /etc/logrotate.conf.

(BSD) uses "newsyslog".

But if system accounting is on, "runacct" does this.

If your machine is used at the time this script is run, you will want to change the time in crontab. If you want more than 1 week's information in these files, you need to change its frequency or take it out all together.

# grep wtmp /etc/cleanup
# If accounting isn't enabled, clean up wtmp and wtmpx,
: Do nothing - accounting will clean up wtmp and wtmpx
[ -f /etc/wtmp ] && >/etc/wtmp
[ -f /etc/wtmpx ] && >/etc/wtmpx

.

Having that run on Sunday is not ideal for forensics - "who logged in over the w weekend?" is not an unusual question.

A good modification might be to output "last" to a file before cleaing it.

~

If you found something useful today, please consider a small donation.



Got something to add? Send me email.





(OLDER)    <- More Stuff -> (NEWER)    (NEWEST)   

Printer Friendly Version

->
-> (SCO Unix) I need information from 'last', but most of it is gone!

1 comment


Inexpensive and informative Apple related e-books:

Take control of Apple TV, Second Edition

Take Control of Apple Mail, Third Edition

Take Control of iCloud

Photos: A Take Control Crash Course

Sierra: A Take Control Crash Course








Sat May 17 05:35:48 2008: 4201   anonymous


Or - rotate utmp/wtmp/wtmpx log files. No logrotate comes with OSR5 so you might want to write a small shell script to suit your purposes. Then use last with -W to specify filename to view a historical wtmp.

------------------------


Printer Friendly Version

Have you tried Searching this site?

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us


Printer Friendly Version





FORTRAN was the language of choice for the same reason that three-legged races are popular. (Ken Thompson)




Linux posts

Troubleshooting posts


This post tagged:

FAQ



Unix/Linux Consultants

Skills Tests

Unix/Linux Book Reviews

My Unix/Linux Troubleshooting Book

This site runs on Linode