Sure, all logins are logged in /var/log/wtmp. The system periodically compresses the logfiles and keeps the compressed archives for several months or years. They're in a binary format, though, so you can't just pop them open in TextEdit. The easiest thing to do is download one of the many log viewers on VersionTracker or MacUpdate. LogMaster or LogMonitor both work fine, although they only display the current log file, not any of the compressed archives.
user console computer.domain Sat Aug 27 16:50 still logged in
user ttyp1 Fri Aug 26 14:33 - crash (1+02:16)
user ttyp1 Fri Aug 26 14:33 - 14:33 (00:00)
user console computer.domain Thu Aug 25 03:14 - crash (2+13:36)
user ttyp1 Fri Jul 22 18:04 - shutdown (33+09:08)
user ttyp1 Fri Jul 22 18:04 - 18:04 (00:00)
user ttyp1 Fri Jul 22 15:02 - 18:04 (03:02)
user ttyp1 Fri Jul 22 15:02 - 15:02 (00:00)
user console computer.local Fri Jul 22 14:45 - 03:12 (33+12:27)
user console computer.domain2 Fri Jul 22 13:23 - 14:44 (01:21)
user console computer.domain Thu Jul 14 19:54 - crash (7+17:28)
user console computer.domain Wed Jul 13 17:07 - crash (1+02:47)
My iBook's been having random stability trouble, as you can see. The different domain and ".local" are there because I moved location and had network trouble as well. I tried "man last" and there's still some things to find out..
ttypX obviously correspond to Terminal windows (just tried opening a new one), console corresponds to the main login. But why are there double entries for the ttypX logins and the other one always has 00:00 duration?
Comments
Dobby.
Originally posted by dobby
$ last USERNAME
Dude. last rocks. So much yet to learn...
Originally posted by Towel
Dude. last rocks. So much yet to learn...
Argh, the crashes!
user ttyp2 Sat Aug 27 17:58 still logged in
user ttyp2 Sat Aug 27 17:58 - 17:58 (00:00)
user ttyp1 Sat Aug 27 17:50 still logged in
user ttyp1 Sat Aug 27 17:50 - 17:50 (00:00)
user console computer.domain Sat Aug 27 16:50 still logged in
user ttyp1 Fri Aug 26 14:33 - crash (1+02:16)
user ttyp1 Fri Aug 26 14:33 - 14:33 (00:00)
user console computer.domain Thu Aug 25 03:14 - crash (2+13:36)
user ttyp1 Fri Jul 22 18:04 - shutdown (33+09:08)
user ttyp1 Fri Jul 22 18:04 - 18:04 (00:00)
user ttyp1 Fri Jul 22 15:02 - 18:04 (03:02)
user ttyp1 Fri Jul 22 15:02 - 15:02 (00:00)
user console computer.local Fri Jul 22 14:45 - 03:12 (33+12:27)
user console computer.domain2 Fri Jul 22 13:23 - 14:44 (01:21)
user console computer.domain Thu Jul 14 19:54 - crash (7+17:28)
user console computer.domain Wed Jul 13 17:07 - crash (1+02:47)
My iBook's been having random stability trouble, as you can see. The different domain and ".local" are there because I moved location and had network trouble as well. I tried "man last" and there's still some things to find out..
ttypX obviously correspond to Terminal windows (just tried opening a new one), console corresponds to the main login. But why are there double entries for the ttypX logins and the other one always has 00:00 duration?