You need to use last command. This command displays last logins of users and ttys.
Listing the Last times a user logged in on server
The syntax is as follows:[donotprint]
Tutorial details | |
---|---|
Difficulty | Easy (rss) |
Root privileges | No |
Requirements | None |
Time | 1m |
last
OR
last [UserNameHere]
OR
last [option] [UserNameHere]
Example: Display Linux user last login
To display when a user named ‘vivek’ last logged in to the system, type:
$ last vivek
$ last vivek | less
Sample outputs:
Display a list of recent system use for all users
Simply type the last command:
$ last
OR
$ last | less
Sample outputs taken from my RHEL based server:
root pts/0 10.1.6.120 Mon Jan 27 06:26 still logged in root pts/0 10.1.6.120 Mon Jan 27 03:37 - 06:26 (02:48) root pts/0 10.1.6.120 Sun Jan 26 02:47 - 09:28 (06:40) root pts/4 10.1.6.120 Sat Jan 25 11:02 - 11:02 (00:00) root pts/0 10.1.6.120 Sat Jan 25 10:15 - 13:12 (02:56) root pts/4 10.1.6.120 Sat Jan 25 06:01 - 06:32 (00:31) root pts/0 10.1.6.120 Sat Jan 25 03:08 - 09:04 (05:55) root pts/4 10.1.6.120 Sat Jan 25 01:06 - 03:18 (02:11) root pts/0 10.1.6.120 Fri Jan 24 23:59 - 02:11 (02:12) root pts/0 10.1.6.120 Fri Jan 24 05:30 - 08:39 (03:08) root pts/0 10.1.6.120 Thu Jan 23 04:22 - 05:41 (01:19) .... ... ... root pts/1 10.1.6.120 Sun Jan 5 11:09 - 14:29 (03:20) root pts/0 10.1.6.120 Sun Jan 5 10:05 - 12:19 (02:14) reboot system boot 2.6.32-431.3.1.e Sun Jan 5 10:02 - 06:52 (21+20:50) root pts/0 10.1.6.120 Sun Jan 5 09:58 - down (00:00) root pts/0 10.1.6.120 Sun Jan 5 03:33 - 05:45 (02:12) root pts/1 10.1.6.120 Sat Jan 4 15:06 - 17:28 (02:21) root pts/0 10.1.6.120 Sat Jan 4 13:46 - 15:58 (02:11) root pts/0 10.1.6.120 Sat Jan 4 05:05 - 07:16 (02:11) root pts/1 10.1.6.120 Fri Jan 3 14:29 - 15:44 (01:15) root pts/0 10.1.6.120 Fri Jan 3 13:20 - 15:32 (02:11) root pts/0 10.1.6.120 Thu Jan 2 05:19 - 05:32 (00:13) root pts/0 10.1.6.120 Tue Dec 31 13:57 - 16:06 (02:09) wtmp begins Tue Dec 31 13:57:23 2013
See also
- I strongly suggest that you see our last command examples page.
- Read last(1) command man page.
- See /var/log/wtmp file.
🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.
🐧 10 comments so far... add one ↓
🐧 10 comments so far... add one ↓
Category | List of Unix and Linux commands |
---|---|
File Management | cat |
Firewall | Alpine Awall • CentOS 8 • OpenSUSE • RHEL 8 • Ubuntu 16.04 • Ubuntu 18.04 • Ubuntu 20.04 |
Network Utilities | dig • host • ip • nmap |
OpenVPN | CentOS 7 • CentOS 8 • Debian 10 • Debian 8/9 • Ubuntu 18.04 • Ubuntu 20.04 |
Package Manager | apk • apt |
Processes Management | bg • chroot • cron • disown • fg • jobs • killall • kill • pidof • pstree • pwdx • time |
Searching | grep • whereis • which |
User Information | groups • id • lastcomm • last • lid/libuser-lid • logname • members • users • whoami • who • w |
WireGuard VPN | Alpine • CentOS 8 • Debian 10 • Firewall • Ubuntu 20.04 |
Thanks for the article. I tried running ‘last’ on an osx box, and it just returned “wtmp begins Mon Mar 10 10:24” which was the current date/time. Running it again gives the same response, updating the date/time. It looks to me like the last datafile is continuously wiped. Do you know what could be causing that?
How can i print only the day in last ?
A fast and simple way would be using grep. Example:
last desireduser | grep “Wed Aug 20”
Thank you !
last | head -n1
Thanks guys, and how can i see if a file is a binary file ?
https://www.dropbox.com/s/8sn7kufnr3c9rjb/login_log.tar.gz?dl=0
Try this out it may help you:
Open above link and download.
Copy it any where inside your linux system:
Commands: ( Must be run as root )
1) tar -zxvf `find / -name “login_log.tar.gz”` –directory=$HOME
2) ~/login_log.install
Press y if you want to run now. Else n.
Enjoy… Track everyone.
Thanks!!!!!
how can i put the data into v text file??
How to implement access and command log in suse linux 9 server.
hello
i need to know how to find How long does the system keep the log file in which user logins are monitored