That's funny. I never knew about the last command.

Does last's log file get deleted every month during the automatic log cleaning of the system? When I check the log it only goes back to Aug 1st, but checking the log from my hint it goes back to June when I first implemented this hint. If the log is deleted every month then I think I'll stick with my solution because checking last on Aug 1st will not tell me what happened on July 31st.

You could likely change the log rolling to not change wtmp. Or, set up a cronjob to execute last and save the output into a file you own.

Last produces binary file with the permissions

-rw-r--r-- 1 root admin 19836 Aug 18 10:09 /var/log/wtmp

The root ownership and read only permissions for non-root users prevents basic abuse. While your children may be trusted to respect parental limits, and thus your script may be fine, for system administrators who need to track usage of a machine, last is very reliable. It also logs ftp, ssh, and telnet access.

"The login hook will be run as root."

Ignore my previous comment.

Although the 'last' commands' login log gets cleaned out every once and a while, it appears that archives are stored in /var/log/wtmp.n.gz where 'n' is sequential to how many times it has been archived. Unzip the file, and use last -f <file> to view the archived log.

Thanks for the tip, it lead me to figure this out.