I track user login times on a couple of shared computers running OSX 10.10.5 using the last command in terminal. It seems after updating from 10.9 the wtmp file gets frequently deleted and only show a few days of history. Is there a command that can stop this from happening? Or an alternative way to track user logins times for the previous month?
On older os, the
periodic script was the culprit. You could see how it prunes the
wtmp file by inspecting the source and by reading the manual page.
The actual archive of login data is stored in
/var/log/monthly.out. If that level of detail isn't sufficient, you could customize the daily or even weekly or the monthly script and extract the data you need in the form you need before the file gets truncated.
Some process is still generating the monthly log in data for each user, but it's summary data and not log in / log out data.
Why not enable parental controls for each user to be tracked and simply log the app usage. You'll know what apps are run when by what user.
If you really need console log in and don't have multiple user switching, that info is available, but I haven't done the research on how to retrieve it yet.