On Raspbian one can read the recent login history using the command 'last'.

Then if one copies the log files in /var/log/ to on a different Linux system and want to read the login, which methods are available? The file /var/log/wtmp and /var/log/lastlog seem binary files and cannot be read using less/vim.

  • You could try last -f file_name - it probably won't give the correct username (because most Linux commands use uid). – Milliways Mar 25 '19 at 7:03
  • So the file /var/log/wtmp does not contain constant usernames, and when the file is read in different system, then the usernames are read differently from the original names? – Nownuri Mar 25 '19 at 7:19
  • Frankly, I don't know - but in general usernames exist in mapping to uid (e.g. ls -lan shows numeric uid - which is what is stored in file attributes, although pi is a directory name). On default Raspbian pi == 1000 – Milliways Mar 25 '19 at 7:53
  • Okay, I found that usernames are read correctly from wtmp. But I have no idea how to read lastlog – Nownuri Mar 25 '19 at 8:25
  • freebsd.org/cgi/… has info - yes, it's freebsd, but posix is posix ... The lastlog file is a linear array of lastlog structures indexed by a user's UID and The utmp file is a linear array of utmp structures indexed by a terminal line number - the structure for both is defined as well – Jaromanda X Mar 25 '19 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.