On Sun, Sep 19, 2004 at 09:05:11PM +0800, John Lee wrote: > How do i retrieve last login details for JUN-2004 > as I can only see SEP-04 now.. > > last | grep user --> only shows SEP i guess > > How can i get JUNE?
Look at the saved copies of wtmp under /var/log. Hmmm... By default newsyslog(1) is setup to keep 4 old copies of the wtmp file around, and to switch to a new file at the start of every month, so you should have: wtmp September (ie. this month) wtmp.0 August wtmp.1 July wtmp.2 June wtmp.3 May still on your system. (Any earlier than May and you'ld have had to retrieve the appropriate wtmp file from backup) So, try: last -f /var/log/wtmp.2 user Cheers, Matthew -- Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK
Description: PGP signature