So like the title says, I logged into my server and I noticed last and lastb seem to have been reset sometime before 00:48 after the new year.

Is this intentional to have it reset, or does it only display the current year's? Or should I be concerned that someone has gotten access to my server?

I do have SSH and HTTP port forwarded out of my network - so it's a live server.

  • 1
    the same person hacked my laptop :) – Jasen Jan 2 '15 at 0:36

The last and lastb commands read /var/log/wtmp and /var/log/btmp respectively. These logs are rotated by logrotate which has is configured in /etc/logrotate.conf and /etc/logrotate.d. The rotation of the two files of interest is managed by the main configuration file. For /var/log/wtmp I have:

/var/log/wtmp {
    create 0664 root utmp
    rotate 1

This means that every month /var/log/wtmp will be moved to /var/log/wtmp.1. So, this is nothing to worry about - to access the old log, just do:

last -f /var/log/wtmp.1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.