3

I'm korean and not familiar with english, but I'm asking to. I'm using CentOS 5.5 and when I commanded 'last' to see who are logged in system, all logs don't have any informantions for year. They only have day, month and time as below.

root pts/0 100.100.100.100 Sat May 24 03:52 still logged in
root tty1 Sat May 24 03:52 still logged in
reboot system boot 2.6.18-194.el5 Sat May 24 03:50 (00:02)
root pts/2 211.45.57.232 Fri May 23 06:03 - crash (21:47)
root pts/0 211.45.60.5 Sat May 17 09:17 - crash (6+18:33)
root pts/0 211.45.57.232 Sat May 17 08:54 - 09:17 (00:22)
root pts/1 100.100.100.100 Sat May 17 05:47 - 06:30 (6+00:42)
root pts/0 100.100.100.100 Sat May 17 05:32 - 07:40 (02:07)
reboot system boot 2.6.18-194.el5 Sat May 17 05:32 (6+22:20)
root pts/1 100.100.100.100 Fri Jan 24 21:27 - 22:05 (00:38)
root pts/0 100.100.100.100 Fri Jan 24 17:44 - crash (112+11:48) root pts/1 100.100.100.100 Fri Jan 24 10:42 - 14:51 (04:08)
root pts/0 100.100.100.100 Fri Jan 24 09:37 - 12:05 (02:27)
root pts/0 100.100.100.100 Fri Jan 24 05:51 - 05:51 (00:00)
root pts/0 100.100.100.100 Fri Jan 24 05:50 - 05:51 (00:00)
root tty1 Fri Jan 24 05:50 - crash (112+23:41) reboot system boot 2.6.18-194.el5 Fri Jan 24 05:49 (119+22:03) root tty1 Sat Jul 2 02:58 - down (00:00)
reboot system boot 2.6.18-194.el5 Sat Jul 2 02:56 (00:02)
root tty1 Sat Jul 2 02:51 - down (00:04)
reboot system boot 2.6.18-194.el5 Sat Jul 2 02:49 (00:06)
root tty1 Sat Jul 2 02:37 - down (00:00)
root tty1 Sat Jul 2 02:35 - 02:37 (00:01)
reboot system boot 2.6.18-194.el5 Sat Jul 2 02:34 (00:03)

All I want to know is what year they have logged in. Thanks for reading my question.

Improve this question

3 Answers 3

Reset to default
4

What you can do is use the -t switch for each year:

last -t 20140101000000

This will show you logins before 2014-01-01 00:00:00. That is up to and including year 2013.

last -t 20130101000000

This will show you logins before 2013-01-01 00:00:00. That is up to and including year 2012.

And so forth doing one step for all years you have in your log.

Improve this answer
2
  • I'm curious, does it only work since the last reboot, or further ?
    – mveroone
    May 23, 2014 at 10:21
  • 1
    Kwaio: The example I commented in you post comes from a server which had about 3-4 reboots during the last couple of years because of relocation (wtmp begins Sat Jan 7 23:09:33 2012)
    – Bgs
    May 23, 2014 at 10:34
6

last -F worked for me on CentOS 6.7.

last -F reboot gives a log of when the server was rebooted.

Though I gather that the -F switch doesn't work on some systems, like Solaris. It's apparently part of GNU's last, though.

Thanks to https://unix.stackexchange.com/a/97597/174520

Improve this answer
-1

Like most command, you will get the year information only if the date is older than 365 days.

Meaning we're the 2014 May 22th, so 2013 May 23th will display just as "May 23th (hour)" but 2013 May 21 will display 2013 in stead of the hour.

Improve this answer
4
  • This is wrong! Just look at his own example. July 2 of last year had no year in it!
    – Bgs
    May 23, 2014 at 10:14
  • as far as I know, July 2nd is less that 365 days ago, if it's 2013
    – mveroone
    May 23, 2014 at 10:19
  • Yeah, right. It was wroing, but I'd like to say that thank you for your answers.
    – Deokyong Song
    May 23, 2014 at 10:23
  • That is indeed right. But you can still check a server with several years worth of lastlog and see that year does not appear. Example with host anonymized: bgs@HOST:~% last -t 20130101000000| head -1 bgs pts/0 HOSTNAME Fri Aug 24 15:16 gone - no logout
    – Bgs
    May 23, 2014 at 10:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.