The information displayed by the
last command is stored in the
wtmp file, which is normally located at
Since this file will grow without any upper limit while the system is being used, the default configuration for most Linux distributions will implement an automated log rotation procedure for this file.
The default rotation for
/var/log/wtmp might be weekly or monthly. Usually some number of old versions of the file are kept as
/var/log/wtmp.2 etc. In some distributions, a datestamp is used instead of an increasing number.
If you need
last output from a previous log rotation cycle, use the
-f option to point the
last command to an older version of the wtmp file. For example:
last -f /var/log/wtmp.1
If you want to change the log rotation cycle of the wtmp file, or tell the system to keep a larger number of previous versions, look into files
/etc/logrotate.d/* - these are where log rotation procedures are typically defined.