Finding login times in Linux

Question

I am trying to figure out times of logins into my systems (basically systems boot). I am making use of `last` Unix command. However, it does not let me pull more than a certain number of entries. I assume that the log file from which it pulls, which is `/var/log/wtmp`, gets overwritten after a certain size. I see that i have a `wtmp.1` file also, so using `-f` parameter i can go back a month further back the logs using this parameter. Wondering if logs further back are archived somewhere. So, my question is: Is there a way to get older entries. The following is the `last` call that i am making: ``` last -n 10000|grep "system" ``` Here are last few lines of the output ``` reboot system boot 3.5.0-36-generic Sun Jul 7 07:07 - 22:08 (15:01) reboot system boot 3.5.0-36-generic Sat Jul 6 23:23 - 23:23 (00:00) reboot system boot 3.5.0-34-generic Sat Jul 6 09:40 - 23:22 (13:42) reboot system boot 3.5.0-34-generic Sat Jul 6 09:38 - 09:39 (00:00) reboot system boot 3.5.0-34-generic Sat Jul 6 0…

Accepted Answer

you don't say what type of unix / linux you are running but on my Ubuntu hosts this works good for last boot times

```
for f in /var/log/wtmp*; do last -f $f reboot;done
```

All it does is find all the wtmp files in /var/log and then filter out the reboot user

Finding login times in Linux

Solution

Problem