0

On Raspbian one can read the recent login history using the command 'last'.

Then if one copies the log files in /var/log/ to on a different Linux system and want to read the login, which methods are available? The file /var/log/wtmp and /var/log/lastlog seem binary files and cannot be read using less/vim.

Nownuri
  • 179
  • 2
  • 9
  • You could try last -f file_name - it probably won't give the correct username (because most Linux commands use uid). – Milliways Mar 25 '19 at 07:03
  • So the file /var/log/wtmp does not contain constant usernames, and when the file is read in different system, then the usernames are read differently from the original names? – Nownuri Mar 25 '19 at 07:19
  • Frankly, I don't know - but in general usernames exist in mapping to uid (e.g. ls -lan shows numeric uid - which is what is stored in file attributes, although pi is a directory name). On default Raspbian pi == 1000 – Milliways Mar 25 '19 at 07:53
  • Okay, I found that usernames are read correctly from wtmp. But I have no idea how to read lastlog – Nownuri Mar 25 '19 at 08:25
  • https://www.freebsd.org/cgi/man.cgi?query=lastlog&sektion=5&manpath=FreeBSD+5.0-RELEASE has info - yes, it's freebsd, but posix is posix ... The lastlog file is a linear array of lastlog structures indexed by a user's UID and The utmp file is a linear array of utmp structures indexed by a terminal line number - the structure for both is defined as well – Jaromanda X Mar 25 '19 at 10:40

0 Answers0