I am trying to create a Unix script that will show the login history for the last 7 days for a user. Is the 'last' command the best option?
I know last /var/adm/utmpx (username) will show all logins for the username but how do i limit it to the last 7 days?
1 Like
Hi @grando
Does your OS have last with the -s option?
$ last --help
Usage:
last [options] [<username>...] [<tty>...]
Show a listing of last logged in users.
Options:
-<number> how many lines to show
-a, --hostlast display hostnames in the last column
-d, --dns translate the IP number back into a hostname
-f, --file <file> use a specific file instead of /var/log/wtmp
-F, --fulltimes print full login and logout times and dates
-i, --ip display IP numbers in numbers-and-dots notation
-n, --limit <number> how many lines to show
-R, --nohostname don't display the hostname field
-s, --since <time> display the lines since the specified time
-t, --until <time> display the lines until the specified time
-p, --present <time> display who were present at the specified time
-w, --fullnames display full user and domain names
-x, --system display system shutdown entries and run level changes
--time-format <format> show timestamps in the specified <format>:
notime|short|full|iso
For example, on my Ubuntu Linux systems:
$ last -s -7days -t today
This will show last for the last week.
See also:
last -s 2020-02-13 -u 2020-02-18
The time passed to the -p , -s and -t options can be specified in the following formats:
YYYYMMDDhhmmss
YYYY-MM-DD hh:mm:ss
YYYY-MM-DD hh:mm (seconds will be set to 00)
YYYY-MM-DD (time will be set to 00:00:00)
hh:mm:ss (date will be set to today)
hh:mm (date will be set to today, seconds to 00)
now
yesterday (time is set to 00:00:00)
today (time is set to 00:00:00)
tomorrow (time is set to 00:00:00)
+5min
-5days
2 Likes
Hi Neo,
My system has -a -n and -f options for the last command.
Thanks
Maybe install a newer or different version of last 
No need to restrict yourself to versions which do not perform as you need.
You have a choice.
Unfortunately I dont have the option to update the version at the moment. With the options I have can anybody suggest the command i would need to run to show only the last 7 days history?
Hey @grando
You should provide full operating system and version details to continue this topic.
1 Like
Solaris 5.11
There is no Solaris version 5.11
There is SunOS version 5.11 that is Solaris version 11.
(Section "version history" in the given wikipedia link.)
Yes I know.
When we ask a user for a version they should provide the correct one.
There is NO Solaris 5.11.
There is Sun OS 5.11
This is not "rocket science" to know your own version when you post to a public forum
See Also:
Posting questions in a public forum is not a kind of game where posters just reply to basic questions with nonsense and false basic information.