3

How can I see the year in the last command on Red Hat 5?

What I have is this:

# last myuser
myuser   pts/0        192.168.1.1    Thu Nov  6 11:46 - 11:53  (00:06)
myuser   pts/0        192.168.1.1    Tue Oct 28 14:47 - 15:17  (00:30)
myuser   pts/0        192.168.1.1    Tue Jul 22 11:57 - 15:19  (03:21)
myuser   pts/0        192.168.1.3   Tue Jun 10 17:33 - 09:45  (16:12)
myuser   pts/0        192.168.1.1    Tue Jun 10 12:46 -.452  (01:05)
myuser   pts/0        192.168.1.1    Tue Jun 10 11:43 - 12:40  (00:56)
myuser   pts/0        192.168.1.1    Thu Apr 17 07:24 - 08:01  (00:37)
myuser   pts/0        192.168.1.1    Tue Apr  8 09:00 - 09:35  (00.3
myuser   pts/0        192.168.1.1    Thu Apr  3 07:33 - 07:47  (00.4
myuser   pts/0        192.168.1.1    Thu Mar 20 08:39 - 08:45  (00:05)
myuser   pts/0        192.168.1.3   Thu Mar.407:17 - 07:59  (00:42)
myuser   pts/0        192.168.1.1    Thu Jan 16 07:06 - 07:37  (00:31)
myuser   pts/1        192.168.1.1    Thu Nov 14 10:15 - 10:35  (00:20)
myuser   pts/0        192.168.1.1    Thu Nov 14 10:03 - 10:35  (00:32)
myuser   pts/0        192.168.1.1    Thu Jul 18 08:23 - 09:38  (01:15)
myuser   pts/0        192.168.1.3   Tue Jul  2 14:15 - 14:52  (00:36)
myuser   pts/0        192.168.1.2   Tue Jul  2 12:26 -.410  (00:43)
myuser   pts/0        192.168.1.2   Thu Jun 27 12:21 - 12:53  (00:32)
myuser   pts/1        192.168.1.3   Thu Apr 25 15:53 - 16:50  (00:57)
myuser   pts/1        192.168.1.3   Thu Apr 25 15:39 - 15:50  (00:11)
myuser   pts/1        192.168.1.3   Thu Apr 25 15:36 - 15:39  (00:02)
myuser   pts/0        192.168.1.4   Thu Apr 25 15:35 - 16:33  (00:57)
myuser   pts/0        192.168.1.4   Tue Apr 23 13:31 - 13:31  (00:00)

wtmp begins Tue May 17 13:03:40 2011

If I grep some month, I won't know which year are the results for.

I know there is -F parameter to show the year, but it doesn't exists on Red Hat 5:

# last -h
last: invalid option -- h
Usage: last [-num | -n num] [-f file] [-t YYYYMMDDHHMMSS] [-R] [-x] [-o] [-w] [username..] [tty..]
jmlrt
  • 83
  • 6

2 Answers2

2

You should be planning to upgrade to EL6 or EL7 ;)

This is a bit of an odd request, since you should have some idea of when people are logging on. Plus multi-year reporting of last logons doesn't seem to be too useful.

Either way, current versions of Linux have the last -F switch, which shows the year in the output.

For your older RHEL5 server, you'll need to specify date ranges with the -t flag.

last -t 20140101000000

This will show everything before the first day of 2014. 

last -t 20130101000000

This will show everything before the first day of 2013.

You should be able to use these outputs to filter what you're looking for.

ewwhite
  • 194,921
  • 91
  • 434
  • 799
  • You can compile/patch/build your own version of `last` as part of the sysvinit-tools package... but it may not be worth the effort :) – ewwhite Nov 07 '14 at 16:43
0

Well upgrading would be the best but it's not possible :)

I solved my problem with the -t flag using a script like that:

# Get all connexions from $USER
last $USER      /tmp/last1-$USER

# Get all connexions from $USER before $DATE
last -t $DATE $USER      /tmp/last2-$USER

diff /tmp/last1-$USER /tmp/last2-$USER

rm -f /tmp/last1-$USER /tmp/last2-$USER
jmlrt
  • 83
  • 6