1

Can't seem to find where this last command gets its information from. Does anyone know what file it uses (specifically for Unix macOS) ?

Tried cat /var/log/wtmp, cat /var/run/utmp, cat /var/log/lastlog but all I get is: cat: [...]: No such file or directory . Tried cat /var/log/system.log and sudo cat /var/audit but these aren't it either. Is it just me or ? Where is this file ?

Improve this question
3
  • What does man last say? On typical unix it is stored in /var/log/wtmp and on the FreeBSD I have handy it is /var/log/utx.log Commented Sep 13, 2018 at 17:10
  • Doesn't say anything about what file it uses. Commented Sep 13, 2018 at 17:12
  • dtruss is Mac's strace equivalent; you should be able to use dtruss to find this information. Commented Sep 13, 2018 at 18:16

2 Answers 2

Reset to default
1

According to the manual (man last refers to man utmpx), /var/run/utmpx.

Improve this answer
1
  • man utmpx only says this about the utmpx file. "Currently logged in users are tracked in /var/run/utmpx", whereas the last command displays the history of all login/outs since the file (that I'm looking for) was created. @DopeGhoti Commented Sep 13, 2018 at 17:49
1

It used to be /var/log/wtmp before Mac OS 10.3, according to Apple header file commentary. That file no longer exists and is not used. The underlying C library functions for accessing the login database, upon which last is based, now talk to ASL.

Further reading

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.