last command only shows few days worth of logins

Question

I often use thelast command to check my systems for unauthorized logins, this command:

last -Fd

gives me the logins where I have remote logins showing with ip.

From man last:

-F     Print full login and logout times and dates.
-d     For non-local logins, Linux stores not only the host name of the remote host but its IP number as well. This option  translates  the  IP
              number back into a hostname.

Question:

One of my systems is only showing a few days worth of logins. Why is that? What can I do when last only gives me few days?

Here is the output in question:

root ~ # last -Fd
user pts/0        111-111-111-111. Wed Oct  8 20:05:51 2014   still logged in                      
user pts/0        host.lan   Mon Oct  6 09:52:01 2014 - Mon Oct  6 09:53:41 2014  (00:01)    
user pts/0        host.lan   Sat Oct  4 10:11:39 2014 - Sat Oct  4 10:12:13 2014  (00:00)    
user pts/0        host.lan   Sat Oct  4 09:31:07 2014 - Sat Oct  4 10:11:00 2014  (00:39)    
user pts/0        host.lan   Sat Oct  4 09:26:04 2014 - Sat Oct  4 09:28:16 2014  (00:02)    

wtmp begins Sat Oct  4 09:26:04 2014

Answer 1

It is likely that logrotate has archived the log(s) of interest and opened a new one. If you have older wtmp files, specify one of those, as for example:

last -f /var/log/wtmp-20141001

Answer 2

The 'last' command reads data from /var/log/wtmp file. If you have logrotate service enabled it probably rotates wtmp file. Check if you have wtmp.1 or wtmp.1.gz file inside of /var/log directory. If you have it (or more similar with next numbers: wtmp.2 wtmp.3, etc) it means wtmp log is rotated. Then you can adjust/disable rotation or use 'last -f wtmp_file' command to check older data.

Answer 3

As suggested by Slm you can use :

$ lastlog -b 0 -t 100

To find out the users that have logged into a system in the last 100 days.