I track user login times on a couple of shared computers running OSX 10.10.5 using the last command in terminal. It seems after updating from 10.9 the wtmp file gets frequently deleted and only show a few days of history. Is there a command that can stop this from happening? Or an alternative way to track user logins times for the previous month?


On older os, the periodic script was the culprit. You could see how it prunes the wtmp file by inspecting the source and by reading the manual page.

The actual archive of login data is stored in /var/log/monthly.out. If that level of detail isn't sufficient, you could customize the daily or even weekly or the monthly script and extract the data you need in the form you need before the file gets truncated.

Some process is still generating the monthly log in data for each user, but it's summary data and not log in / log out data.

Why not enable parental controls for each user to be tracked and simply log the app usage. You'll know what apps are run when by what user.

If you really need console log in and don't have multiple user switching, that info is available, but I haven't done the research on how to retrieve it yet.

| improve this answer | |
  • 1
    I can't remember the last version of OS X that used the wtmp.log. This information is stored by Apple System Logger within a .asl file. The periodic monthly accounting script just calls ac. It doesn't effect the .asl file. There is the possibility you could modify the com.apple.aslmanager.plist and adjust the ttl time to live. – fd0 Sep 17 '15 at 15:09
  • 1
    Oh dear. Thanks fd0. I'll do some research and either edit this or vote up a better answer. – bmike Sep 17 '15 at 15:11
  • @fd0 Hey so I did read the man page, which I should have beforehand, and it (obviously now) says "DEPRECATED". I can't however find the aslmanager.plist file anywhere. If I manually create the file where would it go? bmike Because I want to track each login incidence individually the monthly.out is too short on detail. I'm definitely not experienced enough to customize the script if that would somehow work anyhow. – Darren Sep 18 '15 at 18:29
  • @Darren Sorry - I was delayed in looking at this. I'll see what I can dig up with launchctl – bmike Sep 18 '15 at 20:20
  • @Darren I suggest you read the following manuals: -syslog, syslogd, aslmanager, and asl.conf. asl.conf states the default time to live for wtmp is appox. one year. Two 10.10 machines that I looked at are retaining the default time to live. The aslmanager.plist is in /System/LaunchDaemons. It can be configured with asl.conf. I wouldn't edit the plist. – fd0 Sep 19 '15 at 10:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .