Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [last]

14 questions
13
votes
2 answers

Getting login year data with the 'last' command on linux

On Solaris, there the command 'fwtmp' provide the year information from the wtmp logs. For example: host # /usr/lib/acct/fwtmp < /var/adm/wtmpx > tmp_wtmpx_file host # head -1 tmp_wtmpx_file user123 sshd 1258 7 0000 0000 1226072918 230489 0 29…
Andrew Case
  • 3,409
  • 3
  • 21
  • 38
3
votes
3 answers

Parse different lastlog[s]

I have the lastlog from 100 machines that I need to parse. Since I have them all centrally located, is there a way to parse these? Or do I need to go back to each machine and type the "lastlog" command and then get the output? Thank you.
linuxnoob
  • 33
  • 4
2
votes
0 answers

unknown user in last output

I found a lot of lines (~900) similar to these in the last output of one of my hosts: trustpor ftpd31576 www.trustport.co Tue Oct 1 10:03 - 10:03 (00:00) trustpor ftpd31575 www.trustport.co Tue Oct 1 10:03 - 10:03 (00:00) trustpor…
lorenzo.marcon
  • 1,027
  • 1
  • 11
  • 20
2
votes
1 answer

"last" command indicates someone logged in for 00:00 - was our server compromised?

I noticed the following weird entry from my "last" command from an IP address in Romania: user pts/0 89.123.111.228 Sat Jul 28 12:48 - 12:48 (00:00) I'm wondering if that means I was hacked? But it says they logged in for 0 minutes, does…
Philip Brocoum
  • 123
  • 5
1
vote
2 answers

Start/Stop times of Linux PC

I would like to see the start/stop times of a Linux PC. I found this command, but the output is wrong: last reboot -F reboot system boot 4.15.0-46-generi Thu Mar 14 10:04:27 2019 - Thu Mar 14 15:31:11 2019 (05:26) That's not true. Instead of…
guettli
  • 3,113
  • 14
  • 59
  • 110
0
votes
1 answer

How to find last time server was accessed both Windows and Linux

I'm trying to find if anyone have logged into the servers in past 1 month or not. Servers include both Windows and Linux. Please help if anyone have already working script or suggestion on how to proceed. For Linux i have tried using last command…
ankur
  • 1
0
votes
1 answer

Linux last login get the logins yesterday and email it the next day or specific time via crontab

I need to know the last login yesterday and email it to me via crontab.... Since the last command shows all the login you need to scroll up. Using grep and cut might do the trick.
jmazaredo
  • 202
  • 5
  • 13
0
votes
1 answer

why is cron flooding wtmp and last?

When I type the last command, I see a bunch of entries in there for cron. Every single cron job that gets run creates an entry and it's flooding wtmp with unnecessary entries. Any ideas how I can stop cron from doing that? The entries look like the…
chizou
  • 457
  • 3
  • 8
  • 15
0
votes
1 answer

Viewing older entries for lastb on linux

I have a server (Amazon Linux) that has been up for 261 days: [server]$ uptime 16:29:46 up 261 days, 4:47, 1 user, load average: 0.05, 0.16, 0.18 I am trying to find out if there have been any unsuccessful login attempts over recent…
Garreth McDaid
  • 3,399
  • 26
  • 41
0
votes
1 answer

last command fails - how to fix it so that it works again?

The server is Ubuntu 11.10. When I issue the "last" command from the command line, it gives the following output: # last last: read failed! wtmp begins Fri Apr 18 15:47:48 2014 This I suspect is happening after a probable hacking attempt on the…
jark
  • 23
  • 4
0
votes
3 answers

Copy latest created directory

I would like to make a second backup from the latest created backup. So I tried the shell command: last='ls -tr | tail -1' cp -r /path/.../"$last" /path/.../backup/ but it copies a randome backup. It is working perfect with .zip and .tar files but…
user189113
  • 3
  • 3
0
votes
1 answer

Last command - very strange output

When trying to execute "last" command I am getting my last logins mixed with the content from files that exists on that server. for instance: =0A =0A Sun Jan 20 22:18 - crash (3894+12:33) left" bg =0A …
Pawel Dubiel
  • 183
  • 1
  • 7
0
votes
1 answer

Why does "last" fail on Alpine with "last couldn't open file '/dev/null/wtmp' "?

Why is the last command failing on my fresh install of Alpine 3.12? $ last couldn't open file '/dev/null/wtmp': Not a directory wtmp begins Thu Jan 1 00:00 (on a Linode server if that matters)
Rob Bednark
  • 215
  • 1
  • 2
  • 8
-1
votes
1 answer

Could anyone please tell what the lsof mean is?

please see this image Hi, there. please check this image. I had a suspicious IP address and I ran the last command. Anyone please tell what that lsof is? Did somebody run the lsof command on my server? but I've never run that command
byemen
  • 1