Page 1 of 1

wtmp, btmp, utmp Files

Posted: 28 Jul 2015, 06:49
by donald
Have you ever wondered what the wtmp file in /var/log/ is, and how you can view it's content?
After me please:

This is a (log) List of all users last logged in/out and time, system boot etc.
To view it's content use the "last" command to show who has recently logged in and out (date/time)

basic syntax

Code: Select all

last
last (user name)
If you have more than one wtmp file, (like wtmp.1, because of logrotate), you can specify the File with the -f option.

Note "-f /var/log/wtmp.1" is an example, optional.

Code: Select all

last -f /var/log/wtmp.1
or for a specified user

Code: Select all

last root -f /var/log/wtmp.1
display reboot time

Code: Select all

last reboot -f /var/log/wtmp.1
display shutdown time

Code: Select all

last -x shutdown -f /var/log/wtmp.1
use the same command for utmp / btmp files e.g.

Code: Select all

last -f /var/run/utmp
Happy log file viewing....