The "last" command displays when users logged into your system, when there were reboots and shutdowns, the kernel that was booted... Example:

[root@li-20 root]# last
root     pts/1        zon122191aaa.def Thu Jun 26 14:36 - 15:25  (00:49)    
root     pts/0        zon122191aaa.def Thu Jun 26 13:11   still logged in   
root     pts/0        zon122191aaa.def Thu Jun 26 00:48 - 05:50  (05:01)    
root     tty0                          Tue Jun 24 16:59   still logged in   
reboot   system boot  2.4.21linode4-6u Tue Jun 24 16:58         (2+05:48)   

wtmp begins Tue Jun 24 16:58:25 2003
[root@li-20 root]# 

It also displays where the user came from and what they connected to - (console, ftp, a terminal, etc). "tty0" is the console, where as pts (pseudo terminal) was an SSH or telnet session.

-Chris

If you get an error message that when you run "last" that /var/log/wtmp isn't found, execute the following command:

touch /var/log/wtmp

That will create the initial file.

-Chris

Everytime I do the last command it says my wtmp file is this:

wtmp begins Tue Jul 1 11:40:40 2003

Is there any way so that it doesnt begin on every single day so that I can keep a running list? Thanks.

Is there a cron job that's recreating it?

Look for /etc/logrotate.conf and edit the wtmp section -- if it says "daily" change it to "monthly" ...

-Chris

hah! word. its at monthly but ya.. today is the beginning of the month.