Title
#macos
a

allister

07/20/2022, 6:23 AM
I'm trying to understand how the
last
command works on Mac and the table spec refers to a fuzzed "/var/log/wtmpx" path? it seems to be include'ing <utmpx.h>, and I don't know what that translates to on the file system if there is a (binary or log or otherwise) artifact I'd confirm with. One way or the other, even if I'm trusting the OS itself and not a filesystem artifact, I am trying to understand retention because it seems to be getting purged/trimmed on a schedule I don't understand
s

seph

07/20/2022, 4:05 PM
I’m not going digging through source code. Some high level stuff… unix machines store last login information in the
utmpx
or
wtmpx
system. That is probably the authoritative place to look. (unlike the macOS plist mirroring weirdness) The fuzz path is linux specific, not macOS anyhow. You would need to dig through the OS definitions for this
👍 1