I track user login times on a couple of shared computers running OSX 10.10.5 using the last command in terminal. It seems after updating from 10.9 the wtmp file gets frequently deleted and only show a few days of history. Is there a command that can stop this from happening? Or an alternative way to track user logins times for the previous month?
MacOS – How to stop wtmp from erasing
macosterminalunixuser-account
Related Question
- MacOS – Problem with Photoshop CS6 Freezing up on OSX Mavericks
- MacOS – How to fix constantly resetting HD 4000 GPU
- MacOS – Trackpad unresponsive, or reverted and speed very fast
- Mac OS X unusual bash activity
- Free Space on Hard Drive Fluctuates – Causes and Solutions
- MacBook Pro – Fix Screen Randomly Going Black After Login
Best Answer
On older os, the
periodic
script was the culprit. You could see how it prunes thewtmp
file by inspecting the source and by reading the manual page.The actual archive of login data is stored in
/var/log/monthly.out
. If that level of detail isn't sufficient, you could customize the daily or even weekly or the monthly script and extract the data you need in the form you need before the file gets truncated.Some process is still generating the monthly log in data for each user, but it's summary data and not log in / log out data.
Why not enable parental controls for each user to be tracked and simply log the app usage. You'll know what apps are run when by what user.
If you really need console log in and don't have multiple user switching, that info is available, but I haven't done the research on how to retrieve it yet.