Linux / Unix: Check Last Time User Logged In On The System

I

am a new Unix system admin. How do I find ouw who has recently use the Linux or Unix-like server? Which terminals they used, and when they logged in and out of the my server?

 

You need to use last command. This command displays last logins of users and ttys.

Listing the Last times a user logged in on server

The syntax is as follows:

last

OR

last [UserNameHere]

OR

last [option] [UserNameHere]

Example: Display Linux user last login

To display when a user named ‘vivek’ last logged in to the system, type:

$ last vivek

$ last vivek | less

 

Sample outputs:

Fig.01: last command in action on my Debian base nas server

 

The output in this example tell us when user vivek last logged in. The output will go back for several months or more as last command searches back through the file /var/log/wtmp and displays a list of all users logged in (and out) since that file was created.

Display a list of recent system use for all users

Simply type the last command:

$ last

 

OR

$ last | less

 

Sample outputs taken from my RHEL based server:

root     pts/0        10.1.6.120       Mon Jan 27 06:26   still logged in

root     pts/0        10.1.6.120       Mon Jan 27 03:37 – 06:26  (02:48)

root     pts/0        10.1.6.120       Sun Jan 26 02:47 – 09:28  (06:40)

root     pts/4        10.1.6.120       Sat Jan 25 11:02 – 11:02  (00:00)

root     pts/0        10.1.6.120       Sat Jan 25 10:15 – 13:12  (02:56)

root     pts/4        10.1.6.120       Sat Jan 25 06:01 – 06:32  (00:31)

root     pts/0        10.1.6.120       Sat Jan 25 03:08 – 09:04  (05:55)

root     pts/4        10.1.6.120       Sat Jan 25 01:06 – 03:18  (02:11)

root     pts/0        10.1.6.120       Fri Jan 24 23:59 – 02:11  (02:12)

root     pts/0        10.1.6.120       Fri Jan 24 05:30 – 08:39  (03:08)

root     pts/0        10.1.6.120       Thu Jan 23 04:22 – 05:41  (01:19)

….

root     pts/1        10.1.6.120       Sun Jan  5 11:09 – 14:29  (03:20)

root     pts/0        10.1.6.120       Sun Jan  5 10:05 – 12:19  (02:14)

reboot   system boot  2.6.32-431.3.1.e Sun Jan  5 10:02 – 06:52 (21+20:50)

root     pts/0        10.1.6.120       Sun Jan  5 09:58 – down   (00:00)

root     pts/0        10.1.6.120       Sun Jan  5 03:33 – 05:45  (02:12)

root     pts/1        10.1.6.120       Sat Jan  4 15:06 – 17:28  (02:21)

root     pts/0        10.1.6.120       Sat Jan  4 13:46 – 15:58  (02:11)

root     pts/0        10.1.6.120       Sat Jan  4 05:05 – 07:16  (02:11)

root     pts/1        10.1.6.120       Fri Jan  3 14:29 – 15:44  (01:15)

root     pts/0        10.1.6.120       Fri Jan  3 13:20 – 15:32  (02:11)

root     pts/0        10.1.6.120       Thu Jan  2 05:19 – 05:32  (00:13)

root     pts/0        10.1.6.120       Tue Dec 31 13:57 – 16:06  (02:09)

 

wtmp begins Tue Dec 31 13:57:23 2013

See also

I strongly suggest that you see our last command examples page.

Read last(1).

See /var/log/wtmp file.

 

 

Leave a Reply

Your email address will not be published. Required fields are marked *