We have already discussed about last command on previous post, the following content remote the ssh logged, reboot, shutdown information from logs.
# last
root pts/0 192.168.1.100 Thu Feb 19 21:43 still logged in
root pts/0 192.168.1.100 Thu Feb 19 16:56 - 20:31 (03:35)
root pts/0 192.168.1.113 Thu Feb 19 03:14 - 03:15 (00:01)
root pts/0 192.168.1.100 Sat Jan 24 02:19 - 03:33 (01:14)
reboot system boot 2.6.32-71.29.1.e Sat Jan 24 02:18 - 21:55 (26+19:36)
wtmp begins Sat Jan 24 02:18:28 2015
logged information stored into /var/log/wtmp, /var/log/btmp binary files, but you could erase these files.
# > /var/log/wtmp
# > /var/log/btmp
# > /var/log/btmp
Comments (0)