"last" doesn't work

[Doug Lassiter]

Mac 10.8.5. Unix "last" is supposed to show recent logins by users. When I do "last" on this system, I just get ...

wtmp begins Thu Mar 12 21:30

... and that's it.

Where the date and time is the current date and time. What's going on? Is this system somehow not logging users? Why is the login file getting reset when I make that command?

 

[caribiner23]

I doubt your wtmp log is being cleared when you run the "last"command. Something else must be at work.

What do you get when you run "w" or "uptime"?

 

[Dysfunction]

Do a ls -lh /var/run/utmpx

and lets see the results.

 

[Doug Lassiter]

Result of w is

joe console - 25Feb15 18days -
joe s000 - 14:56 - w
alec s001 76-253-74-142.li Sat 10 6:35 grep


Result of ls -lh /var/run/utmpx is

-rw-r--r-- 1 root daemon 3.1K Mar16 14:56 /var/run/utmmpx

 

[Dysfunction]

Interesting, that's a large enough file to have some decent output. I have 122 lines prior to wtmp begin. Also it's updating (date's correct)... and perms are correct.

~ $ ls -lh /var/run/utmpx;last |wc -l
-rw-r--r--@ 1 root daemon 5.5K Mar 16 18:32 /var/run/utmpx
123

$ find / -name last 2>/dev/null
/usr/bin/last

You're not giving it any switches at all are you? I've seen that do similar..

$ last t

wtmp begins Tue Nov 25 10:33

 

[Doug Lassiter]

So where do I go from here? Not sure what you mean by "switches". "last t" isn't a command.

 

[Doug Lassiter]

OK, now I'm really confused. Doing some research, I see it noted that Apple abandoned wtmp long ago (some say 10.4), so that file is usually now found to be empty in modern OSs. The user logs are now resident in /var/log/asl or /var/run/utmpx. Now, I don't have a clue how to conveniently get a listing from those files that last used to supply from wtmp.

What is peculiar is that in my 10.6.8 machine, the last command works just fine, and wtmp has plenty of stuff in it. It's my 10.8.5 machine that doesn't want to tell me the login history, and seems to have a perpetually empty wtmp file.

 

[Dysfunction]

Well, this will make you even happier then.. My machine is a fresh 10.10.2 build (was never anything other than 10.10).. Which is why I looked at /var/run/utmpx with a hex editor, and it matches my last output.

(there is no t switch, but it causes last to fail identically.. like any other incorrect last switch)

 

[Doug Lassiter]

So "last" works for me as Administrator. But not for a generic user. Geez, it could have just told me that ...

Not completely sure where it gets the info, but it's all there. Probably /var/run/utmpx.

So how can a generic user look at that log in 10.8? As I said, my 10.6 allows a generic user to look at that log.

 

[cradom]

sudo last
Use an admin password.

 

[Doug Lassiter]

Well, if I sudo Admin, I'm not a general user anymore, but hey ...

So let me get this straight. Snow Leopard allows "last" to be used by the general user, but Mountain Lion does not. That kinda sucks.