macOS Terminal – Log File Accessed by `sudo last` Command

bashlogsmacosterminal

The bash command last (needs sudo) prints out logs, which contain information on when different users log in/out of the shell.

I have been looking for the file that stores this information, that last would access. I have checked /var/log/system.log and other files within /var/log.

I have looked everywhere on the internet as well, and cannot find the location.

I have, however, confirmed that the file is within /var/log, because when I did rm -rf /var/log/, sudo last showed empty output until the next time I logged in.

Which file is it? Thanks.

(I am using OS X Mavericks if it makes a difference.)

Best Answer

last derives its output by examining the *.launchd.events.*.stats files in /private/var/log/com.apple.launchd.

Removing the files usually restricts the last output to the last login after rebooting. Consequently some additional file/database/in-memory structure has to exist.

Removing the files doesn't work consistently.

The stats files in the respective user folders (e.g. com.apple.launchd.peruser.0 or com.apple.launchd.peruser.501) are irrelevant!

Related Solutions

IPhone – ssh login attempts logged to on jailbroken iPhone with OpenSSH

I just found the answer to this

you have to manually edit /Library/LaunchDaemons/com.openssh.sshd.plist

change this part:

<key>ProgramArguments</key>
<array>
    <string>/usr/sbin/sshd</string>
    <string>-i</string>
</array>

to this:

<key>ProgramArguments</key>
<array>
    <string>/usr/sbin/sshd</string>
    <string>-E /var/log/auth.log -i</string>
</array>

then reboot or restart sshd

Where does Applescript Event Log go when run under Launchd

To bring the contents of Mateusz's comment here in an answer. Credit to Camelot for the steps.

The AppleScript log statement does not write to the StandardOutPath. Writing to a log file takes 3 steps. The second step may take 2 forms depending of wether you want to save previously written data.

-- Open the log file
set logFile to (open for access POSIX file "/var/tmp/myScript.log" with write permission)
-- Write some data to it (clearing the existing contents)
write "some data" & return to logFile
-- Or, write by appending, some data to the end of existing data
write "some data" & return to logFile starting at eof
-- Close the file
close access logFile

It may help to rewrite the 1st step as 2 statements:

set logFilePath to "/var/tmp/myScript.log"
set logFile to (open for access POSIX file logFilePath with write permission)

I am still searching for an answer regarding the log statements and event log. At this point, I think they go into deep space.

Best Answer

Related Solutions

IPhone – ssh login attempts logged to on jailbroken iPhone with OpenSSH

Where does Applescript Event Log go when run under Launchd

Related Question