wtmp, btmp, utmp Files

[donald]

Have you ever wondered what the wtmp file in /var/log/ is, and how you can view it's content?
After me please:

This is a (log) List of all users last logged in/out and time, system boot etc.
To view it's content use the "last" command to show who has recently logged in and out (date/time)

basic syntax

Code: Select all

last
last (user name)

If you have more than one wtmp file, (like wtmp.1, because of logrotate), you can specify the File with the -f option.

Note "-f /var/log/wtmp.1" is an example, optional.

Code: Select all

last -f /var/log/wtmp.1

or for a specified user

Code: Select all

last root -f /var/log/wtmp.1

display reboot time

Code: Select all

last reboot -f /var/log/wtmp.1

display shutdown time

Code: Select all

last -x shutdown -f /var/log/wtmp.1

use the same command for utmp / btmp files e.g.

Code: Select all

last -f /var/run/utmp

Happy log file viewing....