Despite what I thought, there does not seem to be any concrete/modern answer on the net, so my question is: where does the last
command get its information from? I have found the file before, but months ago, and I can not remember where it is. So what is the directory of the file where last
keeps its log?
EDIT
This is technically the same as this question, except for one thing: "/private/var/log/com.apple.launchd" DOES NOT EXIST on my mac (perhaps it was pre-El Capitan-only) as proven by the fact that
ls /private/var/log | grep "com.apple.launchd"
returns nothing. com.apple.xpc.launchd does exist, but is empty. So please reopen the question, as something is different
Best Answer
Since Mac OS X 10.6 (Snow Leopard) Apple has replaced the
utmp
/wtmp
mechanism with the Apple logging system. Seeman 5 utmpx
for details. Here is a pertinent excerpt:See
man asl
for the programatic interface to the log system. Apple Syslog saves all its utmp/wtmp/lastlog-like information in /var/log/asl/*.