5

My AWS instance has been running since July. I've been logging in roughly once a week.

When I run last on the box, it only see logins from the start of October.

Is there any legitimate reason why I'm not seeing all logins I've ever made, or should I be concerned?

andy
  • 159
  • 1
  • 10

3 Answers3

8

This will most likely be the action of logrotate If you look in /etc/logrotate.conf you'll see something like

/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

Which says rotate the /var/log/wtmp file monthly and keep one previous copy. If you want to keep more then increase the rotate count

rotate count

Log files are rotated count times before being removed or mailed to the address specified in a mail directive. If count is 0, old versions are removed rather than rotated.

If you look in /var/log you'll probably find a selection of files like 

/var/log/wtmp
/var/log/wtmp.1

If you want to access data from an earlier file you can use

last -f /var/log/wtmp.1
user9517
  • 115,471
  • 20
  • 215
  • 297
  • yeah, i can see there's one rotated log. it has an earlier timestamp, so i think it's OK. thanks, I thought the file was /var/log/lastlog – andy Oct 11 '12 at 13:39
  • @andy: man last ... Last searches back through the file /var/log/wtmp (or the file designated by the -f flag) ... – user9517 Oct 11 '12 at 13:41
0

I think you or someone with root privileges has issued 

cat /dev/null > /var/log/wtmp

which will delete the previous logins. check the modification time of wtmp

stat %s /var/log/wtmp
Valentin Bajrami
  • 4,045
  • 1
  • 18
  • 26
0

You are probably experiencing this on a server that is only infrequently accessed, and with a lastlog (/var/log/wtmp) which should be rotated less frequently.

Edit /etc/logrotate.conf Find the /var/log/wtmp section Increase the rotation period, from "monthly" to "yearly", for example.

Now when you use the last command, you will see a longer list of logins, over a longer time span, and you will feel better !

This issue involves some odd psychology involving "paradigms", belief systems and expectations based on conditioning through repetition. I have a proxy server which is not accessed much, and every time I execute "last", the very short list always causes me to feel suspicious. The feeling that something is wrong is merely the psychology of the paradigm that "you are accustomed (thousands of times) to seeing a much longer list of logins on your other servers", therefore you expect a long list ! A paradigm will cause a person to make a mistake over and over, all the while thinking that they did it correctly.

SandPond
  • 17
  • 2
  • I seriously doubt that it's a psych thing to expect a list of logins dating all the way back to the last time a machine was booted and only see a couple of weeks worth of entries. Seems pretty rational to me. – squillman Jun 18 '14 at 16:08
  • Understanding paradigms is a basic necessity for those who wish to excel in any field. "There is a reason for everything", but it often takes time and study to fully realize that, and to begin approaching issues "rationally" ... which YOU claim to be able to do. Many others, however, have not reached that point, and reqire explicit explanations ... which is the intended use of this forum. – SandPond Nov 09 '18 at 15:57