last: show login & reboot information

terminalIf you want to check who were the last users who logged-in to the system, last is a handy command to use. Its counterpart, lastb shows the bad login attempts as well.

  • To log files must be preset for these commands to work. If they are not present by default on your system:
    $ sudo touch /var/log/wtmp
    $ sudo touch /var/log/btmp
  • To get the list of last logged-in users showing time, method and IP address or hostname:
    $ last
    root ssh:notty neo-pc.home Mon Feb 4 18:26 - 18:26 (00:00) 
    root ssh:notty linux-dgrq.home Thu Jan 17 15:28 - 15:28 (00:00) 
    user1 ssh:notty 164.99.139.152 Mon Oct 29 15:05 - 15:05 (00:00) 
    user1 ssh:notty 164.99.139.152 Mon Oct 29 15:03 - 15:03 (00:00)
  • Use lastb if you want to see bad login attempts as well.
  • To know the last users who issued a reboot on the system:
    $ last reboot
    reboot system boot 2.6.37.6-0.11-de Wed Jan 8 10:58 - 06:16 (259+19:17)
    reboot system boot 2.6.37.6-0.11-de Mon Dec 30 12:11 - 06:16 (268+18:05)
    reboot system boot 2.6.37.6-0.11-de Wed Dec 11 14:07 - 16:12 (9+02:05)
    reboot system boot 2.6.37.6-0.11-de Tue Nov 12 15:11 - 14:05 (28+22:53)
    reboot system boot 2.6.37.6-0.11-de Thu Aug 1 15:00 - 15:10 (103+00:10)

To make more sense of the data, try the sac utility. Useful switches for sac:

-d: List login time per day instead of the default total time.
-p: List login time per user instead of the default total time.
-t: List login time per tty line instead of the default total time.

Comment

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s