On Solaris, there the command 'fwtmp' provide the year information from the wtmp logs. For example:
host # /usr/lib/acct/fwtmp < /var/adm/wtmpx > tmp_wtmpx_file
host # head -1 tmp_wtmpx_file
user123 sshd 1258 7 0000 0000 1226072918 230489 0 29 host123.desktop.ourhost.com Fri Nov 7 09:48:38 2008
On Linux, the 'last' outputs the data without the year information, and I don't seem to be able to find a utility similar to 'fwtmp' on Linux to add the year data. The 'lastlog' command includes year in the output, but only looks up the users that are in the passwd file (not against ldap or other user databases by default). Is there a utility on Linux that will output the year along with the other data from 'last'?
Best Answer
So, use
last -F