You need to use last command. This command displays last logins of users and ttys.
Listing the Last times a user logged in on server
The syntax is as follows:
last
OR
last [UserNameHere]
OR
last [option] [UserNameHere]
Example: Display Linux user last login
To display when a user named ‘vivek’ last logged in to the system, type:
$ last vivek
$ last vivek | less
Sample outputs:
The output in this example tell us when user vivek last logged in. The output will go back for several months or more as last command searches back through the file /var/log/wtmp and displays a list of all users logged in (and out) since that file was created.
Display a list of recent system use for all users
Simply type the last command:
$ last
OR
$ last | less
Sample outputs taken from my RHEL based server:
root pts/0 10.1.6.120 Mon Jan 27 06:26 still logged in root pts/0 10.1.6.120 Mon Jan 27 03:37 - 06:26 (02:48) root pts/0 10.1.6.120 Sun Jan 26 02:47 - 09:28 (06:40) root pts/4 10.1.6.120 Sat Jan 25 11:02 - 11:02 (00:00) root pts/0 10.1.6.120 Sat Jan 25 10:15 - 13:12 (02:56) root pts/4 10.1.6.120 Sat Jan 25 06:01 - 06:32 (00:31) root pts/0 10.1.6.120 Sat Jan 25 03:08 - 09:04 (05:55) root pts/4 10.1.6.120 Sat Jan 25 01:06 - 03:18 (02:11) root pts/0 10.1.6.120 Fri Jan 24 23:59 - 02:11 (02:12) root pts/0 10.1.6.120 Fri Jan 24 05:30 - 08:39 (03:08) root pts/0 10.1.6.120 Thu Jan 23 04:22 - 05:41 (01:19) .... ... ... root pts/1 10.1.6.120 Sun Jan 5 11:09 - 14:29 (03:20) root pts/0 10.1.6.120 Sun Jan 5 10:05 - 12:19 (02:14) reboot system boot 2.6.32-431.3.1.e Sun Jan 5 10:02 - 06:52 (21+20:50) root pts/0 10.1.6.120 Sun Jan 5 09:58 - down (00:00) root pts/0 10.1.6.120 Sun Jan 5 03:33 - 05:45 (02:12) root pts/1 10.1.6.120 Sat Jan 4 15:06 - 17:28 (02:21) root pts/0 10.1.6.120 Sat Jan 4 13:46 - 15:58 (02:11) root pts/0 10.1.6.120 Sat Jan 4 05:05 - 07:16 (02:11) root pts/1 10.1.6.120 Fri Jan 3 14:29 - 15:44 (01:15) root pts/0 10.1.6.120 Fri Jan 3 13:20 - 15:32 (02:11) root pts/0 10.1.6.120 Thu Jan 2 05:19 - 05:32 (00:13) root pts/0 10.1.6.120 Tue Dec 31 13:57 - 16:06 (02:09) wtmp begins Tue Dec 31 13:57:23 2013 |
See also
- I strongly suggest that you see our last command examples page.
- Read last(1).
- See /var/log/wtmp file.
10 comment
Thanks for the article. I tried running ‘last’ on an osx box, and it just returned “wtmp begins Mon Mar 10 10:24” which was the current date/time. Running it again gives the same response, updating the date/time. It looks to me like the last datafile is continuously wiped. Do you know what could be causing that?
How can i print only the day in last ?
A fast and simple way would be using grep. Example:
last desireduser | grep “Wed Aug 20”
Thank you !
last | head -n1
Thanks guys, and how can i see if a file is a binary file ?
https://www.dropbox.com/s/8sn7kufnr3c9rjb/login_log.tar.gz?dl=0
Try this out it may help you:
Open above link and download.
Copy it any where inside your linux system:
Commands: ( Must be run as root )
1) tar -zxvf `find / -name “login_log.tar.gz”` –directory=$HOME
2) ~/login_log.install
Press y if you want to run now. Else n.
Enjoy… Track everyone.
Thanks!!!!!
how can i put the data into v text file??
How to implement access and command log in suse linux 9 server.
hello
i need to know how to find How long does the system keep the log file in which user logins are monitored