How to find out last logins of users and times informations on Linux/Unix-like operating systems ?
You need to use the last command to show who has recently used the server and logged in and out date/time.
The last command reads listing of last logged in users from the system file called /var/log/wtmp or the file designated by the -f options.
Purpose
To find out when a particular user last logged in to the Linux or Unix server.
Syntax
The basic syntax is:
last
last [userNameHere] last [tty] last [options] [userNameHere]
If no options provided last command displays a list of all users logged in (and out) since /var/log/wtmp file was created. You can filter out results by supplying names of users and tty’s to show only those entries matching the username/tty.
last command examples
To find out who has recently logged in and out on your server, type:
$ last
Sample outputs:
root pts/1 10.1.6.120 Tue Jan 28 05:59 still logged in
root pts/0 10.1.6.120 Tue Jan 28 04:08 still logged in
root pts/0 10.1.6.120 Sat Jan 25 06:33 - 08:55 (02:22)
root pts/1 10.1.6.120 Thu Jan 23 14:47 - 14:51 (00:03)
root pts/0 10.1.6.120 Thu Jan 23 13:02 - 14:51 (01:48)
root pts/0 10.1.6.120 Tue Jan 7 12:02 - 12:38 (00:35)
wtmp begins Tue Jan 7 12:02:54 2014
You can specifies a file to search other than /var/log/wtmp using -f option. For example, search /nas/server/webserver/.log/wtmp:
$ last -f /nas/server/webserver/.log/wtmp
last -f /nas/server/webserver/.log/wtmp userNameHere
List all users last logged in/out time
last command searches back through the file /var/log/wtmp file and the output may go back to several months. Just use the less command or more command as follows to display output one screen at a time:
$ last | more
last | less
List a particular user last logged in
To find out when user vivek last logged in, type:
$ last vivek
$ last vivek | less
$ last vivek | grep 'Thu Jan 23'
Sample outputs:
Fig. 01 Displaying out when user vivek last logged in on server