Ubuntu lastlog only shows a few entries
My AWS instance has been running since July. I've been logging in roughly once a week.
When I run last
on the box, it only see logins from the start of October.
Is there any legitimate reason why I'm not seeing all logins I've ever made, or should I be concerned?
This will most likely be the action of logrotate If you look in /etc/logrotate.conf you'll see something like
/var/log/wtmp {
missingok
monthly
create 0664 root utmp
rotate 1
}
Which says rotate the /var/log/wtmp file monthly and keep one previous copy. If you want to keep more then increase the rotate count
rotate count
Log files are rotated count times before being removed or mailed to the address specified in a mail directive. If count is 0, old versions are removed rather than rotated.
If you look in /var/log you'll probably find a selection of files like
/var/log/wtmp
/var/log/wtmp.1
If you want to access data from an earlier file you can use
last -f /var/log/wtmp.1