I'd like the last command to display login/logout information located on a volume from another Mac. I've mounted that volume at /Volumes/1013.

Where does last get that information from? I'd rather open the relevant log file and read it directly than use Terminal.

Image added as answer to user nohillside below:

enter image description here

Solved by Jaume (details below), basically:

sudo chroot /Volumes/1013/ last -10

works for High Sierra, it didn't work for El Capitan, still very good though.

  • 1
    Possible duplicate of How do I find the log for the shutdown process? – Saaru Lindestøkke Aug 5 '18 at 12:31
  • 1
    What do you mean by "other volume"? Is this volume on another Mac than the one you are currently logged in? Can you remotely log into the other Mac through ssh? – nohillside Aug 5 '18 at 13:30
  • 1
    OTOH, if /Volumes/1013 is located on another (physical) Mac and just got mounted on the Mac you are sitting in front of you may need to log into the other Mac remotely and access the log there. Or use last -h HOST – nohillside Aug 8 '18 at 16:56
  • 2
    @Antonio23249 So you want last to read the login/logout information from another macOS volume (mounted at /Volumes/1013). The problem is that last can only read a utmpx file located in the standard path: /var/run/utmpx. There is a nice workaround to get around this limitation, though, use chroot. Simply run sudo chroot /Volumes/1013/ last -10 and you will get the information you are looking for. No need to write any programs. If your question gets reopened, I'll add this comment as an answer. – jaume Aug 9 '18 at 20:41
  • 1
    @jaume This question has been reopened – grg Aug 9 '18 at 21:36

last gets its information from /var/run/utmpx, a file that records user and tty sessions, shutdowns and reboots on the current system. utmpx is a binary file, which means you can't use less or grep to read it or search for keywords.

So to get the session information of the other Mac, we want last to read /Volumes/1013/var/run/utmpx.

Unfortunately, last can't be told to read a file different than /var/run/utmpx, but this is where chroot comes to the rescue. chroot takes two arguments, a path and a command, sets the command's perceived root directory to the specified path and executes it.

In our case, this is the command we need (type your login password when asked):

sudo chroot /Volumes/1013/ last

This command changes the root directory to point to /Volumes/1013 so that when last reads /var/run/utmpx, it actually reads /Volumes/1013/var/run/utmpx.

You can pass options to last, if you wish, or pipe the output to grep for more relevant results, for example:

sudo chroot /Volumes/1013/ last -10 | grep <some user>

If the command above doesn't work (for example, you get a segmentation fault), try this:

sudo chroot /Volumes/1013/ /Volumes/1013/usr/bin/last -10 | grep <some user>

that is, run the executable from the other Mac.

Note that there's a limit on how far back you can go with the macOS version with either method.

For example, with macOS "Sierra" 10.12, last worked as expected, while with OS X "Mavericks" 10.9, last only prints one line and then hangs. dtruss shows that a serious incompatibility is the reason for the hang:

$ sudo dtruss -p 39542
dtrace: system integrity protection is on, some features will not be available
SYSCALL(args)        = return
dtrace: 3870 dynamic variable drops with non-empty dirty list
lseek(0x8, 0x4000, 0x0)      = 16384 0
dtrace: error on enabled probe ID 2175 (ID 945: syscall::read_nocancel:return): invalid kernel access in action #12 at DIF offset 68

You can overcome this limitation by plugging the drive to a Mac running an older version of macOS.

For more information on chroot, run man chroot in Terminal.

| improve this answer | |
  • @Antonio23249 Have you had a chance to test the procedure I describe in my answer? I modified the last step, now it should work. I'd appreciate it if you could provide some feedback on it or, if it answers you question, mark it as the accepted answer. – jaume Aug 21 '18 at 12:07
  • it worked!, at least for High Sierra. Do you know how to get it for other macOS versions such as 10.10, 10.11? I tried for 10.11 and it gave me "Segmentation fault: 11". Thanks a lot, and sorry I took long to answer, I've been so busy. – Antonio23249 Aug 24 '18 at 20:42
  • @Antonio23249 I'm glad it worked on High Sierra. To get it to work on other macOs versions you need to have a Mac running that OS version, mount the drive and use the chroot trick as explained in my answer... it seems that the format of utmpx has changed and High Sierra's last chokes on an old file from 10.11. – jaume Aug 25 '18 at 14:47
  • @Antonio23249 I've realized that the most probable reason for the segmentation fault is not the format of utmpx, but shared libraries last is linked to, so disregard my previous comment. Try sudo chroot /Volumes/<volume name> /Volumes/<volume name>/usr/bin/last -10 and report back (this might work with macOS 10.11 or even 10.10), but be aware that there's a limit on how far back you can go, see my answer for more details, I've edited it to include this and more information. – jaume Aug 26 '18 at 9:37

According to man last the relevant information is read from the utmpx file which (see man 5 utmpx) is stored in /var/run/utmpx. So if you are mounting volumes from another Mac on your network and the /var/ hierarchy of said Mac is accessible through the mount point you will find the data in /Volumes/1013/var/run/utmpx. Because utmpx is a binary format you would need to write your own little program to read it though (see man endutxent for the relevant access functions).

You could also try to use the -h host option of last to read the entries directly over the network (probably requires remote login to be enabled, never have used this and don't have a second Mac right now to try it).

| improve this answer | |
  • Hi there, thanks for your anwer. Well, I opened that utmpx for the startup drive and just shows a few lines (please check picture I added to original post). So you say I'd need to write a program? Is there now way to use Last and a path or something. I'm in the process of learning to use Terminal but don't know how to do this yet. – Antonio23249 Aug 9 '18 at 11:02
  • @Antonio23249 last can only read the local file on the standard path. Why can‘t you run last on the computer where the file is created? – nohillside Aug 9 '18 at 11:31
  • @nohillside There is a much easier approach to this: chroot. This simple command: sudo chroot /Volumes/1013/ last -10 will get exactly the information the OP is asking for (tested with a mounted drive with Sierra on it). I've added a comment to the OP's question with this information, if the question gets reopened, I'll add it as an answer. – jaume Aug 9 '18 at 20:49
  • 1
    @jaume Nice one! Question is open again, go ahead! – nohillside Aug 10 '18 at 4:16
  • Thanks nohillside, that was the one!: sudo chroot /Volumes/1013/ last -10, worked very well, at least for High Sierra. Do you know how to get it for other macOS versions such as 10.10, 10.11? I tried for 10.11 and it gave me "Segmentation fault: 11". Thanks a lot! – Antonio23249 Aug 24 '18 at 20:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .