Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!


Click here to return to the 'Create a login/logout tracking log file for all users' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Create a login/logout tracking log file for all users
Authored by: regulus on Aug 18, '06 09:01:56AM

That's funny. I never knew about the last command.

Does last's log file get deleted every month during the automatic log cleaning of the system? When I check the log it only goes back to Aug 1st, but checking the log from my hint it goes back to June when I first implemented this hint. If the log is deleted every month then I think I'll stick with my solution because checking last on Aug 1st will not tell me what happened on July 31st.



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: judielaine on Aug 18, '06 09:29:24AM

You could likely change the log rolling to not change wtmp. Or, set up a cronjob to execute last and save the output into a file you own.

Last produces binary file with the permissions

-rw-r--r-- 1 root admin 19836 Aug 18 10:09 /var/log/wtmp

The root ownership and read only permissions for non-root users prevents basic abuse. While your children may be trusted to respect parental limits, and thus your script may be fine, for system administrators who need to track usage of a machine, last is very reliable. It also logs ftp, ssh, and telnet access.



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: judielaine on Aug 18, '06 10:01:52AM

"The login hook will be run as root."

Ignore my previous comment.



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: gunnmjk on Aug 19, '06 02:30:35AM

Although the 'last' commands' login log gets cleaned out every once and a while, it appears that archives are stored in /var/log/wtmp.n.gz where 'n' is sequential to how many times it has been archived. Unzip the file, and use last -f <file> to view the archived log.

Thanks for the tip, it lead me to figure this out.



[ Reply to This | # ]