User-agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2
On 31/01/08 5:14, Chris Saldanha wrote:
Hi,
I note that on 10.5 "Leopard" client OS machines, the /var/log/wtmp
file is
no longer created and so I have no idea where the 'last' command gets its
data.
The 'last' command on my own Mac shows only the last 2-3 days of login
records, and doesn't go back farther. Queries using Console's log query
system only show the same records, albeit in a cryptic format.
I would normally use 'last -f' to read one of the rolled wtmp log
files from
earlier, but these files are no longer created...
Is there historical login/logout lists kept with the new logging system?
Where are they or how can we access them?
Hello Chris,
This has been briefly outlined in recent thread on this list, "Currently
Active (foreground) Console Session".
As this is the opportunity to file the info under a more appropriate
subject, please find it reproduced hereafter:
The info is now stored through the asl(3) system, in /var/log/asl.db.
Login-like events may be isolated with:
syslog -k Facility com.apple.system.lastlog
and logouts with:
syslog -k Facility com.apple.system.utmpx
(add option -F raw to get full details)
Now, according to the man page for syslogd(8), those records should by
default be kept a very long time in asl.db.
But this doesn't seem to be the case on my box too.
I'm not sure whether I'm misreading the man page(s) or if there's some
bug somewhere...
HTH,
Axel
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Client-management mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/client-management/email@hidden
