This got me interested so did some digging on my 10.5 box (my world
is still 99% 10.4 ) combined with some google. You are correct about
10.5 being different - looks like Apple deprecated the old utmp
interface (that used wtmp and lastlog).
I didn't figure out how/when that file is rotated, though I'll admit
I only looked for about 10 minutes.
Tom "Macintosh Doctor" Johnson
email@hidden
On Jan 21, 2008, at 16:18, henri wrote:
Thank you for your help.
Part of the reason 'last' is not accessing the older entries is
that 10.4.x and 10.5.x are configured differently. Sorry, I failed
to mentioned that I am running Mac OS 10.5.1.
A little investigation revealed that 'last' under Mac OS 10.4.x
access the data in '/var/log/wtmp' as you mentioned. However,
'last' under Mac OS 10.5.x retrieves the information from a
different data store, which seems to be cleaned out more frequently
than '/var/log/wtemp' under 10.4.x.
The data store accessed by 'last' is not mentioned in the manual on
Mac OS 10.5.1. In addition '/var/log/wtmp' is not available under
Mac OS 10.5.1.
I will start looking at 'dscl' and will report back if I discover
how to access the extended history of this information.
I feel that I have more of an understating of what is happening
now, even if it is not the full picture.
Thank you again so much.
Hmmm, well mine contain the information for a lot longer than a few
days, but our setups may be different.
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Client-management mailing list (Client-
email@hidden)
Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/client-management/palantir%
40purdue.edu
