Where Are Linux Login Records Stored?
Where Linux keeps wtmp and btmp login records, which commands read them, and the rotation caveat involved.
Last updated
Linux records logins in a binary wtmp file that the last command reads newest-first, with btmp beside it for failed attempts. Rotation archives older months into numbered files that plain last never opens. The files only log when present; deletion silently disables recording.
Suspicious-access hunts start with last, widen to rotated files, and correlate with auth logs. Reboot and shutdown entries ride the same stream as logins. Create missing files with touch to re-enable logging after cleanup accidents.
Where Linux stores this, by platform
/var/log/wtmp
Binary login records read newest-first by last, with btmp for failures beside it. Rotation archives to numbered files needing explicit -f reads. Missing files disable logging silently; recreate with touch. Correlate with auth logs for incident work.
Frequently asked questions
how do I see logins older than a month
Read the rotated archives explicitly with last -f pointing at each wtmp.N file. Plain last stops at the current file boundary. Logrotate ages these out monthly on many distros, so old months vanish by policy.
how do I audit failed logins
Check lastb against btmp for failed attempts alongside last for successes. Missing files mean logging is off; create them with touch to enable. Harden with fail2ban rather than watching logs by hand.
old archives will not parse
Parse with utmpdump or dedicated tools when record sizes changed across versions. Binary formats differ subtly between eras. lastlog tracks per-user last times in a separate file worth checking too.
Notice an outdated path? Let us know.