Ubuntu – Access to logs of startup and shut down

command linelogloggingreboot

My question is inspired by project rawhen

This project used the command last -R -F reboot (163rd line in source code) to see periods when computer was running. You can see in docs, that this command allowed us to look at for example 83 days ago - 447 hours.

original-doc

The project has not been updated for 4 years.

2 years ago on this site this question was asked: How to read older login info using the "last" command? and the answer suggests:

last -2000 -f /var/log/wtmp.1                       // 83 lines (28 days)

If I filter this I obtain.

last -R -F reboot -f /var/log/wtmp.1                // 33 lines (28 days)

but in this answer the number of lines proposed is 2000, and there seems to be an assumption of logs like /var/log/wtmp.x where x is a number.

In my /var/log there are only two files wtmp:

wc /var/log/wtmp*
    3    19  6144 /var/log/wtmp
   37   253 93696 /var/log/wtmp.1
   40   272 99840 together

And these files contain data only from the last 1-2 months.

My question is:

How to get access to oldest logs or prevent Ubuntu from deleting them, or save these logs in one file (I need only the reboot filter) without problems with concatenating these data.

My system is Ubuntu 16.04. It is standard home edition, not server.

It could be an accident, but I see, that in rawhen it showed 478 h when in the last month computer was turned on for 447 h, and in this month 10 h. Is there any time of running system after which logs are deleted?

Best Answer

I'm not sure if I correctly undrestand your question, however to address what you asked (Bold section), you should change logrotate configurations.

Have a look at this file:

less /etc/logrotate.conf

there should be lines like:

/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

If you remove these lines from file, "logrotate" does not remove this log anymore, you can change "monthly" to "yearly" to make it remove files after a year; rotate 1 means keep one backup before removing the old one which comes to:

$ ls /var/log/wtmp*
/var/log/wtmp  /var/log/wtmp.1

If you change it to 2, you're going to get:

$ ls /var/log/wtmp*
/var/log/wtmp  /var/log/wtmp.1  /var/log/wtmp.2
Related Question