User-agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2
On 21/01/08 22:18, henri wrote:
[...]
A little investigation revealed that 'last' under Mac OS 10.4.x
access the data in '/var/log/wtmp' as you mentioned. However, 'last'
under Mac OS 10.5.x retrieves the information from a different data
store, which seems to be cleaned out more frequently than
'/var/log/wtemp' under 10.4.x.
The data store accessed by 'last' is not mentioned in the manual on
Mac OS 10.5.1. In addition '/var/log/wtmp' is not available under Mac
OS 10.5.1.
Hello Henri,
The info is now stored through the asl(3) system, in /var/log/asl.db.
Login-like events may be isolated with:
syslog -k Facility com.apple.system.lastlog
and logouts with:
syslog -k Facility com.apple.system.utmpx
(add option -F raw to get full details)
Now, according to the man page for syslogd(8), those records should by
default be kept a very long time in asl.db.
But this doesn't seem to be the case on my box too.
I'm not sure whether I'm misreading the man page(s) or if there's some
bug somewhere...
