wtmp, btmp, utmp Files

Post tutorials, HOWTO's and other useful resources here.
donald
Full of knowledge
Full of knowledge
Posts: 2063
Joined: 17 Jun 2013, 13:17
Distribution: Porteus 3.2.2 XFCE 32bit
Location: Germany

wtmp, btmp, utmp Files

Post#1 by donald » 28 Jul 2015, 06:49

Have you ever wondered what the wtmp file in /var/log/ is, and how you can view it's content?
After me please:

This is a (log) List of all users last logged in/out and time, system boot etc.
To view it's content use the "last" command to show who has recently logged in and out (date/time)

basic syntax

Code: Select all

last
last (user name)
If you have more than one wtmp file, (like wtmp.1, because of logrotate), you can specify the File with the -f option.

Note "-f /var/log/wtmp.1" is an example, optional.

Code: Select all

last -f /var/log/wtmp.1
or for a specified user

Code: Select all

last root -f /var/log/wtmp.1
display reboot time

Code: Select all

last reboot -f /var/log/wtmp.1
display shutdown time

Code: Select all

last -x shutdown -f /var/log/wtmp.1
use the same command for utmp / btmp files e.g.

Code: Select all

last -f /var/run/utmp
Happy log file viewing....