We have a server, and I tried to check the output of the last command.

For most users in the system the last command is working.

When it comes to root, or to another user the output of last is as follows:

wtmp begins Fri Dec 9 07:14:25 2017

I have tried logging in and logging out of all users to see what is being captured, and this is still the output.

I am trying to understand if someone has modified the log, or if this is normal?

  • 1
    How are those users logging in? – Stéphane Chazelas Dec 21 '17 at 9:17
  • @StéphaneChazelas using SSH – CP3O Dec 21 '17 at 11:15
  • That they are logging in as root using SSH seems unlikely, given how hard operating systems people have pushed for this not to be possible in the default configuration over the past few years. Are they really logging in as root? Or are you conflating this with logging in as another user and then adding root privileges in the login session with the su command? – JdeBP Dec 21 '17 at 11:57

Same on my (Ubuntu) system which I (presumptuously?) consider untampered. If the timestamp is the last time you booted the system this can be normal. This can be distro-dependent (on Ubuntu (workstation) root never logs in...).

Not all system-altering actions result in a entry in wtmp/last, you can access files via SFTP if there is an SSH access, and these connections are tracked by /var/log/auth.log


The information displayed by the last command is stored in the wtmp file, which is normally located at /var/log/wtmp.

Since this file will grow without any upper limit while the system is being used, the default configuration for most Linux distributions will implement an automated log rotation procedure for this file.

The default rotation for /var/log/wtmp might be weekly or monthly. Usually some number of old versions of the file are kept as /var/log/wtmp.1, /var/log/wtmp.2 etc. In some distributions, a datestamp is used instead of an increasing number.

If you need last output from a previous log rotation cycle, use the -f option to point the last command to an older version of the wtmp file. For example:

last -f /var/log/wtmp.1

If you want to change the log rotation cycle of the wtmp file, or tell the system to keep a larger number of previous versions, look into files /etc/logrotate.conf and /etc/logrotate.d/* - these are where log rotation procedures are typically defined.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.