User account login question

Running Red Hat 7.2. Is there an alternative to using the “last” command? A consultant is claiming billable hours on 5/27 and I need to see if he had at least logged onto the box that day. I tried the command “last” but the …/wtmp file only goes back a week (probably wiped by a cron job) and this particular server was reloaded with RH about a month ago and hasn’t been set up per policy yet. I am not as familiar with Linux, is there some other command(s) I can try that might show account activity that I need to find? Thanks!

Regards,
David