Linux Display Date And Time Of Login

How do I display user last login date and time under Linux operating systems?

Linux use the following two files to keep track of user login sessions:

a] /var/run/utmp – List of current login sessions.

b] /var/log/wtmp – List of previous login sessions.

c] /var/log/btmp – List all the bad login attempt.

last command

The last command searches back through the file /var/log/wtmp file and displays a list of all users logged in (and out) since that file was created. Names of users and tty’s can be given, in which case last will show only those entries matching the arguments. Names of ttys can be abbreviated, thus last 0 is the same as last tty0. Type the following command:
last username

Sample outputs:

vivek    pts/3        :0.0             Thu Oct 29 00:46   still logged in   
vivek    pts/0        :0.0             Wed Oct 28 23:14   still logged in   
vivek    pts/2        :0.0             Wed Oct 28 22:12 - 23:11  (00:58)    
vivek    pts/0        :0.0             Wed Oct 28 21:43 - 23:11  (01:27)    
vivek    tty7         :0               Wed Oct 28 21:41   still logged in 

Task: Find Out Who Was Logged In At A Particular Time

To display the state of logins as of the specified time to determine easily who was logged in at a particular time specify that time with -t option and look for “still logged in”.
last -t 20091028231100 username

Task: Show Only Tty Matching Entries

Use the following syntax:
last tty
last tty2
last pts/3

lastb command

The lastb command is the same as last command, except that by default it shows a log of all the bad login attempts, enter:
lastb username
lastb vivek
lastb pts/2

How do I See All Failed Login Count and Other Information?

I recommend configuring PAM and use faillog command display all failed login attempts for given usernames.

🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.

🐧 4 comments so far... add one

CategoryList of Unix and Linux commands
Disk space analyzersdf duf ncdu pydf
File Managementcat cp mkdir tree
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Modern utilitiesbat exa
Network UtilitiesNetHogs dig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg glances gtop jobs killall kill pidof pstree pwdx time vtop
Searchingag grep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
4 comments… add one
  • Jose Tapia Apr 13, 2013 @ 8:24

    Great info thanks :D

  • greg Apr 15, 2013 @ 6:23

    thanks for the helpful information.

    are there any conditions that we should be worried about under which a lastb command will return a “command not found” message in terminal?

    i entered lastb and got that message.

    • Fort C. Apr 4, 2014 @ 7:15

      if “lastb” is installed and you got the “command not found” ,
      it means the command “lastb” is not in your path.
      usually it is installed at /usr/bin, which is normally in your path. so it could be that you don’t have it installed. (moreover, “lastb” would require “root” or “sudo” password/privilege to execute)

  • Fort C. Apr 4, 2014 @ 7:04

    Hello, the “last” command may show too few lines, truncated by when the “wtmp begins”.

    If I want to get the last info as long as possible (e.g., to see if my laptop was hacked by some guy using my username, but from IP unknow to me), how can I output the missing “last” info? (If I use “last -2000”, intend to see 2000 lines of output, but the command may only return just a few lines, anything that happened before the damn “wtmp begins” would be truncated.)

    Just wondering if you have some magical way to show all the login info.

    Thank you

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre> for code samples. Still have questions? Post it on our forum