MacOS: What file does the command `last` get its information from?
Clash Royale CLAN TAG#URR8PPP
up vote
1
down vote
favorite
Can't seem to find where this last command gets its information from. Does anyone know what file it uses (specifically for Unix macOS) ?
Tried cat /var/log/wtmp, cat /var/run/utmp, cat /var/log/lastlog but all I get is: cat: [...]: No such file or directory . Tried cat /var/log/system.log and sudo cat /var/audit but these aren't it either. Is it just me or ? Where is this file ?
files find osx macintosh last
edited Sep 25 at 11:43
Sparhawk
8,53863489
asked Sep 13 at 17:06
Lion
957
add a comment |Â
up vote
1
down vote
favorite
Can't seem to find where this last command gets its information from. Does anyone know what file it uses (specifically for Unix macOS) ?
Tried cat /var/log/wtmp, cat /var/run/utmp, cat /var/log/lastlog but all I get is: cat: [...]: No such file or directory . Tried cat /var/log/system.log and sudo cat /var/audit but these aren't it either. Is it just me or ? Where is this file ?
files find osx macintosh last
edited Sep 25 at 11:43
Sparhawk
8,53863489
asked Sep 13 at 17:06
Lion
957
What doesman lastsay? On typical unix it is stored in/var/log/wtmpand on the FreeBSD I have handy it is/var/log/utx.log
– Cupcake Protocol
Sep 13 at 17:10
Doesn't say anything about what file it uses.
– Lion
Sep 13 at 17:12
dtrussis Mac'sstraceequivalent; you should be able to usedtrussto find this information.
– Wildcard
Sep 13 at 18:16
I think these are now stored in Apple SysLog (ASL) database files in/var/log/asl/*.
– Christopher
Sep 13 at 20:25
add a comment |Â
up vote
1
down vote
favorite
up vote
1
down vote
favorite
Can't seem to find where this last command gets its information from. Does anyone know what file it uses (specifically for Unix macOS) ?
Tried cat /var/log/wtmp, cat /var/run/utmp, cat /var/log/lastlog but all I get is: cat: [...]: No such file or directory . Tried cat /var/log/system.log and sudo cat /var/audit but these aren't it either. Is it just me or ? Where is this file ?
files find osx macintosh last
edited Sep 25 at 11:43
Sparhawk
8,53863489
asked Sep 13 at 17:06
Lion
957
Can't seem to find where this last command gets its information from. Does anyone know what file it uses (specifically for Unix macOS) ?
Tried cat /var/log/wtmp, cat /var/run/utmp, cat /var/log/lastlog but all I get is: cat: [...]: No such file or directory . Tried cat /var/log/system.log and sudo cat /var/audit but these aren't it either. Is it just me or ? Where is this file ?
files find osx macintosh last
files find osx macintosh last
edited Sep 25 at 11:43
Sparhawk
8,53863489
asked Sep 13 at 17:06
Lion
957
edited Sep 25 at 11:43
Sparhawk
8,53863489
asked Sep 13 at 17:06
Lion
957
edited Sep 25 at 11:43
Sparhawk
8,53863489
edited Sep 25 at 11:43
Sparhawk
8,53863489
edited Sep 25 at 11:43
Sparhawk
8,53863489
8,53863489
asked Sep 13 at 17:06
Lion
957
asked Sep 13 at 17:06
Lion
957
asked Sep 13 at 17:06
Lion
957
957
What doesman lastsay? On typical unix it is stored in/var/log/wtmpand on the FreeBSD I have handy it is/var/log/utx.log
– Cupcake Protocol
Sep 13 at 17:10
Doesn't say anything about what file it uses.
– Lion
Sep 13 at 17:12
dtrussis Mac'sstraceequivalent; you should be able to usedtrussto find this information.
– Wildcard
Sep 13 at 18:16
I think these are now stored in Apple SysLog (ASL) database files in/var/log/asl/*.
– Christopher
Sep 13 at 20:25
add a comment |Â
What doesman lastsay? On typical unix it is stored in/var/log/wtmpand on the FreeBSD I have handy it is/var/log/utx.log
– Cupcake Protocol
Sep 13 at 17:10
Doesn't say anything about what file it uses.
– Lion
Sep 13 at 17:12
dtrussis Mac'sstraceequivalent; you should be able to usedtrussto find this information.
– Wildcard
Sep 13 at 18:16
I think these are now stored in Apple SysLog (ASL) database files in/var/log/asl/*.
– Christopher
Sep 13 at 20:25
What does
man last say? On typical unix it is stored in /var/log/wtmp and on the FreeBSD I have handy it is /var/log/utx.log– Cupcake Protocol
Sep 13 at 17:10
What does
man last say? On typical unix it is stored in /var/log/wtmp and on the FreeBSD I have handy it is /var/log/utx.log– Cupcake Protocol
Sep 13 at 17:10
Doesn't say anything about what file it uses.
– Lion
Sep 13 at 17:12
Doesn't say anything about what file it uses.
– Lion
Sep 13 at 17:12
dtruss is Mac's strace equivalent; you should be able to use dtruss to find this information.– Wildcard
Sep 13 at 18:16
dtruss is Mac's strace equivalent; you should be able to use dtruss to find this information.– Wildcard
Sep 13 at 18:16
I think these are now stored in Apple SysLog (ASL) database files in
/var/log/asl/*.– Christopher
Sep 13 at 20:25
I think these are now stored in Apple SysLog (ASL) database files in
/var/log/asl/*.– Christopher
Sep 13 at 20:25
add a comment |Â
2 Answers
2
active
oldest
votes
up vote
2
down vote
According to the manual (man last refers to man utmpx), /var/run/utmpx.
answered Sep 13 at 17:13
DopeGhoti
41.3k55180
man utmpxonly says this about theutmpxfile. "Currently logged in users are tracked in /var/run/utmpx", whereas thelastcommand displays the history of all login/outs since the file (that I'm looking for) was created. @DopeGhoti
– Lion
Sep 13 at 17:49
add a comment |Â
up vote
2
down vote
It used to be /var/log/wtmp before Mac OS 10.3, according to Apple header file commentary. That file no longer exists and is not used. The underlying C library functions for accessing the login database, upon which last is based, now talk to ASL.
Further reading
- Jonathan de Boyne Pollard (2018). The Unix login database. Frequently Given Answers.
answered Sep 14 at 0:16
JdeBP
29.7k461136
add a comment |Â
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
2
down vote
According to the manual (man last refers to man utmpx), /var/run/utmpx.
answered Sep 13 at 17:13
DopeGhoti
41.3k55180
man utmpxonly says this about theutmpxfile. "Currently logged in users are tracked in /var/run/utmpx", whereas thelastcommand displays the history of all login/outs since the file (that I'm looking for) was created. @DopeGhoti
– Lion
Sep 13 at 17:49
add a comment |Â
up vote
2
down vote
According to the manual (man last refers to man utmpx), /var/run/utmpx.
answered Sep 13 at 17:13
DopeGhoti
41.3k55180
man utmpxonly says this about theutmpxfile. "Currently logged in users are tracked in /var/run/utmpx", whereas thelastcommand displays the history of all login/outs since the file (that I'm looking for) was created. @DopeGhoti
– Lion
Sep 13 at 17:49
add a comment |Â
up vote
2
down vote
up vote
2
down vote
According to the manual (man last refers to man utmpx), /var/run/utmpx.
answered Sep 13 at 17:13
DopeGhoti
41.3k55180
According to the manual (man last refers to man utmpx), /var/run/utmpx.
answered Sep 13 at 17:13
DopeGhoti
41.3k55180
answered Sep 13 at 17:13
DopeGhoti
41.3k55180
answered Sep 13 at 17:13
DopeGhoti
41.3k55180
answered Sep 13 at 17:13
DopeGhoti
41.3k55180
41.3k55180
man utmpxonly says this about theutmpxfile. "Currently logged in users are tracked in /var/run/utmpx", whereas thelastcommand displays the history of all login/outs since the file (that I'm looking for) was created. @DopeGhoti
– Lion
Sep 13 at 17:49
add a comment |Â
man utmpxonly says this about theutmpxfile. "Currently logged in users are tracked in /var/run/utmpx", whereas thelastcommand displays the history of all login/outs since the file (that I'm looking for) was created. @DopeGhoti
– Lion
Sep 13 at 17:49
man utmpx only says this about the utmpx file. "Currently logged in users are tracked in /var/run/utmpx", whereas the last command displays the history of all login/outs since the file (that I'm looking for) was created. @DopeGhoti– Lion
Sep 13 at 17:49
man utmpx only says this about the utmpx file. "Currently logged in users are tracked in /var/run/utmpx", whereas the last command displays the history of all login/outs since the file (that I'm looking for) was created. @DopeGhoti– Lion
Sep 13 at 17:49
add a comment |Â
up vote
2
down vote
It used to be /var/log/wtmp before Mac OS 10.3, according to Apple header file commentary. That file no longer exists and is not used. The underlying C library functions for accessing the login database, upon which last is based, now talk to ASL.
Further reading
- Jonathan de Boyne Pollard (2018). The Unix login database. Frequently Given Answers.
answered Sep 14 at 0:16
JdeBP
29.7k461136
add a comment |Â
up vote
2
down vote
It used to be /var/log/wtmp before Mac OS 10.3, according to Apple header file commentary. That file no longer exists and is not used. The underlying C library functions for accessing the login database, upon which last is based, now talk to ASL.
Further reading
- Jonathan de Boyne Pollard (2018). The Unix login database. Frequently Given Answers.
answered Sep 14 at 0:16
JdeBP
29.7k461136
add a comment |Â
up vote
2
down vote
up vote
2
down vote
It used to be /var/log/wtmp before Mac OS 10.3, according to Apple header file commentary. That file no longer exists and is not used. The underlying C library functions for accessing the login database, upon which last is based, now talk to ASL.
Further reading
- Jonathan de Boyne Pollard (2018). The Unix login database. Frequently Given Answers.
answered Sep 14 at 0:16
JdeBP
29.7k461136
It used to be /var/log/wtmp before Mac OS 10.3, according to Apple header file commentary. That file no longer exists and is not used. The underlying C library functions for accessing the login database, upon which last is based, now talk to ASL.
Further reading
- Jonathan de Boyne Pollard (2018). The Unix login database. Frequently Given Answers.
answered Sep 14 at 0:16
JdeBP
29.7k461136
answered Sep 14 at 0:16
JdeBP
29.7k461136
answered Sep 14 at 0:16
JdeBP
29.7k461136
answered Sep 14 at 0:16
JdeBP
29.7k461136
29.7k461136
add a comment |Â
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f468846%2fmacos-what-file-does-the-command-last-get-its-information-from%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
What does
man lastsay? On typical unix it is stored in/var/log/wtmpand on the FreeBSD I have handy it is/var/log/utx.log– Cupcake Protocol
Sep 13 at 17:10
Doesn't say anything about what file it uses.
– Lion
Sep 13 at 17:12
dtrussis Mac'sstraceequivalent; you should be able to usedtrussto find this information.– Wildcard
Sep 13 at 18:16
I think these are now stored in Apple SysLog (ASL) database files in
/var/log/asl/*.– Christopher
Sep 13 at 20:25