In Linux, finding the last login time is to identify the last logged user in the system. This information is stored in the “/var/log/wtmp” file, which records all logs (logins/logouts) on the system. It is beneficial to monitor the activity of the users, identify inactive users, or simply keep track of users’ activity on the system.
Considering its significance, this article will explain multiple methods to find the last login on Linux:
- Method 1: last Command
- Method 2: lastlog Command
- Method 3: Accessing /var/log/auth.log File
- Method 4: who Command
- Method 5: lastb Command
Method 1: Using the last Command
The “last” command displays a list of the last logged-in users on the system. It reads from the file “wtmp”, which contains detailed information on log history.
Example:
An example is considered to display the last logged-in users. For this, type the “last” command in the terminal:
$ last
The output shows a list of logged-in and out users. It includes the user’s name, the terminal they logged in from, the date and time of the login, and the date and time of the logout.
Method 2: Using the lastlog Command
The “lastlog” command shows the time of the last login for all users. It reads from the file “/var/log/lastlog”, which contains a record of the last login time for each user.
Example:
To display the last login time for a particular user, execute the “lastlog” with the “u” option by specifying the name of username:
$ lastlog -u roger
The output shows the last login time for the “roger” user.
Method 3: Using /var/log/auth.log
The “/var/log/auth.log” file contains a record of all authentication events on the system, including logins and logouts.
Example:
To view the contents of this file, execute the “cat” command by specifying the “/var/log/auth.log” path:
$ cat /var/log/auth.log
The output shows login events in the terminal.
Method 4: Using who Command
The “who” command displays a list of all currently logged-in users on the system. It provides information including username, terminal, date, and time of the login for each logged-in user.
Example:
An example is carried out to view the current login information. For this, simply type the “who” command in the terminal:
$ who
The above figure shows the username “itslinuxfoss”, terminal “tty2”, and the date and time of the login for each logged-in user “2023-02-14 23:31”.
Method 5: Using lastb Command
The “lastb” command shows a list of failed login attempts on the system. It reads from the file ”/var/log/btmp”, which contains a record of all failed login attempts.
Example:
To display the failed login attempts, execute the “lastb” command in the terminal with the “sudo” privileges:
$ sudo lastb
It shows a list of users who have unsuccessfully attempted to log in to the system. It includes the user’s name (roger), the terminal (pts/0) they attempted to log in from, and the date and time of the failed attempt (Wed Feb 14 00:53).
Conclusion
Linux offers the “last”, “lastlog”, “/var/log/auth.log”, “who” and “lastb” commands to find last login information on the system. This information includes the username, terminal, date, and time for each logged-in user in the operating system.
This guide has illustrated all possible methods to find the last login information on Linux.
