Unix and Linux Stack Exchange
Unix and Linux Stack Exchange

Questions tagged [wtmp]

/var/log/wtmp is used by the last(1) utility to indicate last logins of users, ttys and hosts

18 questions
6
votes
2 answers

How to run fake-hwclock before /var/log/wtmp is updated?

I have a raspberry pi and every reboot I see this output in last: root@RaspberryPi:~# last | grep boot reboot system boot 4.4.0-1055-raspi Thu Jan 1 01:00 still running reboot system boot 4.4.0-1055-raspi Thu Jan 1 01:00 still…
Roman Gaufman
  • 191
  • 3
  • 11
6
votes
1 answer

utmp, wtmp and btmp: what is the 'tmp'

From the earlier question: why are utmp, wtmp and btmp called as they are? I would like to now what the 'tmp' part is. Is it 'temp/temporary'. As you can see from the earlier question, that part wasn't answered.
bitofagoob
  • 1,335
  • 2
  • 15
  • 24
5
votes
1 answer

Stop excessive logging of SUDO & SSH logins to syslog & wtmp for a specific user account

I have a monitoring server (‘ClusterControl’) which uses a regular user account to login using an ‘interactive shell’ and runs some sudo maintenance commands. This account logs-in via an SSH Key (passwordless) 4 times per minute it seems. The…
Tony Barganski
  • 370
  • 4
  • 9
4
votes
1 answer

How to get rid of `mosh` spamming `last -f /var/log/wtmp`?

Ever since I've started using mosh, I'm getting way too many entries in my /var/log/wtmp file of last(1) on a Linux box. cnst pts/8 172.56.2x.yz via Mon May 19 08:19 still logged in cnst pts/8 mosh [50892] Mon May 19…
cnst
  • 3,223
  • 2
  • 23
  • 44
3
votes
1 answer

What causes wtmp to be cleared?

I noticed that on one of my machines the last command returned nothing. I determined the cause of this to be an empty /var/log/wtmp file. What would cause this to be empty? I assume the "tmp" means temporary, but what and where decides how temporary…
qq4
  • 509
  • 5
  • 12
3
votes
3 answers

How can I get the number of logins each day in the current month using awk?

I want to find out how many users logged in each day to my server in the current month. Starting from the first day of the month. Preferably I would like to use awk to do this. My output should look something like this: Apr 1: numOfLogins Apr 2:…
Paralyz3d
  • 147
  • 5
1
vote
0 answers

Ubuntu last reboot - repeating end time

I'm seeing the following events and I'm not sure why and how. reboot system boot Tue Dec 31 13:31:03 2019 still running reboot system boot Mon Dec 30 14:15:35 2019 - Tue Dec 31 13:30:46 2019 (23:15) reboot system boot Sun Dec 29 14:17:08…
lalatnayak
  • 11
  • 3
1
vote
2 answers

Does utmp log contain 'logout' information?

I have a test yesterday. A question is Choose the one that is wrong about log files. utmp contains login and logout information of the users who are currently logged onto the system loginlog records successful login attempts I know the…
Miracle444
  • 13
  • 3
1
vote
0 answers

Changing default log dir of btmp and wtmp

I've mounted my external drive which serves as different log dir. Everything is configured to write to my external location named /var/log_external, and I am wondering, is possible to change default dir of wtmp and btmp to something like…
fugitive
  • 1,543
  • 19
  • 33
1
vote
1 answer

Which software/commands can I use to delete certain IP from wtmp, btmp, lastlog?

If my aim is to delete IP 1.2.3.4 from: /var/log/wtmp, /var/log/btmp, /var/log/lastlog Which commands can I use on CentOS 6.7 64bit Linux? I see I can't delete it using sed as it is some binary file or such.
16851556
  • 201
  • 2
  • 11
1
vote
3 answers

Garbage hex bytes in wtmp file

I have been trying to extract the boot and login history for a test PC running RHEL 5.8 with some kernel updates. I started by using last -f /var/log/wtmp, and noticed some strange results. Further investigation showed that there are large blocks of…
DanS
  • 203
  • 1
  • 3
  • 8
0
votes
1 answer

How to loop trough wtmp and extract certain data?

I am using the following command to save wtmp (last command) to a logfile: last -F | grep -i -e pv -e nv -e pp > last.log Result: I want to extract the username (first block) and the time of login (second block) using a bash script. The problem I…
Niek Jonkman
  • 173
  • 1
  • 1
  • 4
0
votes
1 answer

Missing shutdown entries in wtmp despite graceful reboots

Linux system with kernel 4.14.76 and last from util-linux 2.35.1. I am using last -x reboot shutdown to detect abrupt shutdowns and power loss. To my understanding, a clean reboot should show as a pair of shutdown and reboot entries in wtmp. This is…
Neal Eastwood
  • 43
  • 1
  • 7
0
votes
0 answers

/var/log/wtmp non volatile storage

I have a question regarding something what i consider unusual behavior related to the logging file /var/log/wtmp There is a server which had Ubuntu 14.04.5 LTS minimal server installed and running for a while. At some point in time, it was decided…
Tito
  • 101
  • 1
0
votes
1 answer

Why don't my wtmp/utmp reset the user count?

On a normal working Linux machine the command w report 2 users(because 2 users are connected) w 19:23:19 up 1:53, 2 users, load average: 0,44, 0,63, 0,81 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT after reboot report…
elbarna
  • 12,050
  • 22
  • 92
  • 170
1
2