How do I display user last login date and time under Linux operating systems?
Linux use the following two files to keep track of user login sessions:
a] /var/run/utmp - List of current login sessions.
b] /var/log/wtmp - List of previous login sessions.
c] /var/log/btmp - List all the bad login attempt.
The last command searches back through the file /var/log/wtmp file and displays a list of all users logged in (and out) since that file was created. Names of users and tty's can be given, in which case last will show only those entries matching the arguments. Names of ttys can be abbreviated, thus last 0 is the same as last tty0. Type the following command:
vivek pts/3 :0.0 Thu Oct 29 00:46 still logged in vivek pts/0 :0.0 Wed Oct 28 23:14 still logged in vivek pts/2 :0.0 Wed Oct 28 22:12 - 23:11 (00:58) vivek pts/0 :0.0 Wed Oct 28 21:43 - 23:11 (01:27) vivek tty7 :0 Wed Oct 28 21:41 still logged in
Task: Find Out Who Was Logged In At A Particular Time
To display the state of logins as of the specified time to determine easily who was logged in at a particular time specify that time with -t option and look for "still logged in".
last -t YYYYMMDDHHMMSS
last -t 20091028231100 username
Task: Show Only Tty Matching Entries
Use the following syntax:
The lastb command is the same as last command, except that by default it shows a log of all the bad login attempts, enter:
How do I See All Failed Login Count and Other Information?
I recommend configuring PAM and use faillog command display all failed login attempts for given usernames.