first(1) is an adaptation of the standard Solaris
last(1) command but adds a triple of features that
make life easier when inspecting very old or long wtmpx files:
last(1)only includes the time of logout and the length of the session).
-uoutputs timestamp fields as seconds from the beginning of 1970 (easier automated processing).
Example output from
mcarpent pts/2 foxtrot Tue Mar 9 20:15 - 20:37 (00:22)Example output from
mcarpenter pts/2 foxtrot Tue Mar 9 20:15:00 2010 - Tue Mar 9 20:37:39 2010 (00:22)Example output from
mcarpenter pts/2 foxtrot 1268162100 - 1268163459 (00:22)
User Commands first(1) NAME first - an adaptation of last to display login and logout information about users and terminals SYNOPSIS first [-a] [-n number | -number] [-f filename] [-u] [name | tty]... DESCRIPTION first is identical to last apart from the following changes: Expanded username column from 8 to 16 characters. Full length timestamps for both logon and logoff, including year. Option to display timestamps as seconds from 1970 (UNIX epoch time) for easier processing. These changes are intended to make last more convenient for processing long (old) wtmpx files. The first command looks in the /var/adm/wtmpx file, which records all logins and logouts, for information about a user, a terminal, or any group of users and terminals. Argu- ments specify names of users or terminals of interest. If multiple arguments are given, the information applicable to any of the arguments is printed. For example, first root console lists all of root's sessions, as well as all ses- sions on the console terminal. first displays the sessions of the specified users and terminals, most recent first, indicating the times at which the session began, the dura- tion of the session, and the terminal on which the session took place. first also indicates whether the session is con- tinuing or was cut short by a reboot. The pseudo-user reboot logs in when the system is shutdown and when it reboots. Thus, first reboot gives an approximate record of when the operating system instance was shutdown and when it rebooted. This can be used to calculate the availability of the operating system over time. SunOS 5.11 Last change: 09 Mar 2010 1 User Commands first(1) first with no arguments displays a record of all logins and logouts, in reverse order. If first is interrupted, it indicates how far the search has progressed in /var/adm/wtmpx. If interrupted with a quit signal (generated by a CTRL-\), first indicates how far the search has progressed, and then continues the search. OPTIONS The following options are supported: -a Displays the hostname in the last column. -f filename Uses filename as the name of the accounting file instead of /var/adm/wtmpx. -n number|-number Limits the number of entries displayed to that specified by number. These options are identi- cal; the -number option is provided as a transition tool only and is removed in future releases. -u Displays times as seconds from beginning of 1970 (UNIX epoch time). ENVIRONMENT VARIABLES Date and time format is based on locale specified by the LC_ALL, LC_TIME, or LANG environments, in that order of priority. FILES /var/adm/wtmpx accounting file ATTRIBUTES See attributes(5) for descriptions of the following attri- butes: SunOS 5.11 Last change: 09 Mar 2010 2 User Commands first(1) __________________________________________________________________ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | |_____________________________|___________________________________| | Availability | http://github.com/mcarpenter/first| |_____________________________|___________________________________| AUTHOR Martin Carpenter, firstname.lastname@example.org, Copyright 2010. SEE ALSO last(1), utmpx(4), attributes(5) SunOS 5.11 Last change: 09 Mar 2010 3