/var/adm/wtmp contains login and logoff information in reverse chronological order.
The last command can be used to view the contents of wtmp.
An example of the output of last is shown below.
$ last oracle pts/2 200.254.1.207 Jun 29 15:36 - 15:44 (00:08) oracle pts/2 192.253.1.20 Jun 29 15:34 - 15:35 (00:01) oracle pts/2 192.252.1.20 Jun 29 15:32 - 15:34 (00:02) oracle pts/2 192.252.1.20 Jun 29 15:27 - 15:31 (00:04) oracle pts/0 192.252.1.14 Jun 29 15:16 - 18:08 (02:52) root pts/1 168.29.10.7 Jun 29 15:03 - 00:55 (09:51) oracle pts/0 211.251.1.14 Jun 29 14:50 - 15:15 (00:25) oracle pts/2 211.252.1.14 Jun 28 23:49 - 23:49 (00:00) oracle pts/2 211.252.1.14 Jun 28 23:48 - 23:48 (00:00) oracle pts/3 211.253.1.14 Jun 28 23:48 - 00:06 (00:18) oracle pts/2 211.251.1.14 Jun 28 23:46 - 23:48 (00:01) oracle pts/0 211.252.1.14 Jun 28 23:44 - 00:05 (00:20) root pts/0 176.29.10.7 Jun 28 23:00 - 23:01 (00:00) root pts/0 176.29.10.7 Jun 28 22:57 - 23:00 (00:02) root pts/0 176.29.10.7 Jun 28 21:44 - 22:55 (01:10) root pts/0 176.29.10.7 Jun 28 21:43 - 21:43 (00:00) root pts/0 176.29.10.7 Jun 28 21:41 - 21:41 (00:00) oracle pts/1 212.252.1.14 Jun 28 17:18 - 00:07 (06:48)
wtmp will need to be truncated periodically to prevent it from getting too big.
To do so use the fwtmp command as shown below.
/usr/lib/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp.out tail -500 /tmp/wtmp.out > /tmp/wtmp.small /usr/lib/acct/fwtmp -ci < /tmp/wtmp.small > /var/adm/wtmp rm /tmp/wtmp.out rm /tmp/wtmp.small
