Today we will see how to view user login history in linux.
For this, we will use “last” command which gives login history for any specific username mentioned.
If we run last command without any argument, it will show login history for all users.
By default, the login history information is read from file “/var/log/wtmp”.
Last command output has following columns:
nglinux pts/4 :0.0 Thu Dec 14 22:38 - 22:38 (00:00)
Value Description
ngelinux User name
pts/4 Tty device number
:0.0 IP:Terminal
Thu Dec 14 22:38 Login date and time
22:38 Logout time
(00:00) Total working time
1. Default command Output
[root@nglinux ~]# last root pts/5 172.21.49.223 Thu May 30 20:13 still logged in root pts/4 172.21.49.223 Thu May 30 19:25 still logged in nglinux pts/3 :0.0 Thu May 30 19:24 still logged in nglinux pts/2 :0.0 Thu May 30 19:24 still logged in nglinux pts/1 :0.0 Thu May 30 19:24 still logged in nglinux pts/0 :0.0 Thu May 30 19:24 still logged in nglinux tty1 :0 Thu May 30 19:23 still logged in reboot system boot 2.6.32-696.el6.i Thu May 30 19:19 - 01:00 (05:41) root pts/1 192.168.253.1 Thu Dec 14 23:11 - crash (531+19:08) nglinux pts/4 :0.0 Thu Dec 14 22:38 - 22:38 (00:00) nglinux pts/3 :0.0 Thu Dec 14 22:38 - 22:38 (00:00) nglinux pts/2 :0.0 Thu Dec 14 22:38 - 22:38 (00:00) nglinux pts/1 :0.0 Thu Dec 14 22:38 - 22:38 (00:00) nglinux tty1 :0 Thu Dec 14 22:37 - 22:39 (00:01) root pts/1 :0.0 Thu Dec 14 22:35 - 22:35 (00:00) root tty1 :0 Thu Dec 14 22:35 - 22:37 (00:01) root pts/0 192.168.253.1 Thu Dec 14 22:34 - crash (531+19:45) nglinux pts/1 :0.0 Thu Dec 14 22:33 - 22:33 (00:00) nglinux pts/1 :0.0 Thu Dec 14 22:32 - 22:32 (00:00) nglinux pts/0 :0.0 Thu Dec 14 22:32 - 22:33 (00:00) nglinux tty1 :0 Thu Dec 14 22:32 - 22:35 (00:03) reboot system boot 2.6.32-696.el6.i Thu Dec 14 22:31 - 01:00 (532+01:29) root pts/1 192.168.253.1 Thu Dec 14 22:23 - down (00:07) root pts/0 192.168.253.1 Thu Dec 14 22:20 - down (00:10) reboot system boot 2.6.32-696.el6.i Thu Dec 14 22:16 - 22:31 (00:15) nglinux pts/2 :0.0 Thu Dec 14 22:15 - 22:15 (00:00) nglinux pts/1 :0.0 Thu Dec 14 22:14 - down (00:00) nglinux tty1 :0 Thu Dec 14 22:14 - down (00:01) root pts/0 192.168.253.1 Thu Dec 14 22:13 - down (00:01) reboot system boot 2.6.32-696.el6.i Thu Dec 14 22:02 - 22:15 (00:12) reboot system boot 2.6.32-696.el6.i Thu Dec 14 09:20 - 22:00 (12:40) root pts/2 :0.0 Mon Dec 11 03:09 - crash (3+06:10) root tty1 :0 Mon Dec 11 03:09 - crash (3+06:10) nglinux pts/2 :0.0 Mon Dec 11 01:36 - 03:08 (01:31) nglinux tty1 :0 Mon Dec 11 01:36 - 03:08 (01:32) root pts/3 192.168.253.1 Sun Dec 10 23:06 - 23:06 (00:00) root pts/2 :0.0 Sun Dec 10 23:06 - 01:36 (02:30) root tty1 :0 Sun Dec 10 23:06 - 01:36 (02:30) root pts/1 192.168.253.1 Sun Dec 10 21:29 - crash (3+11:50) root pts/0 192.168.253.1 Sun Dec 10 21:25 - crash (3+11:54) reboot system boot 2.6.32-696.el6.i Sun Dec 10 21:24 - 22:00 (4+00:36) root pts/3 192.168.253.1 Sun Dec 10 21:05 - down (00:14) root pts/2 192.168.253.1 Sun Dec 10 20:50 - down (00:29) nglinux pts/1 :0.0 Sun Dec 10 08:36 - down (12:43) nglinux pts/3 :0.0 Sun Dec 10 08:36 - 08:36 (00:00) nglinux pts/3 :0.0 Sun Dec 10 08:35 - 08:36 (00:00) nglinux pts/3 :0.0 Sun Dec 10 08:33 - 08:33 (00:00) nglinux pts/1 :0.0 Sun Dec 10 08:29 - 08:36 (00:06) nglinux pts/1 :0.0 Sun Dec 10 08:27 - 08:27 (00:00) nglinux pts/3 :0.0 Sun Dec 10 08:24 - 08:24 (00:00) nglinux pts/2 :0.0 Sun Dec 10 08:22 - 08:36 (00:13) nglinux pts/2 :0.0 Sun Dec 10 08:22 - 08:22 (00:00) nglinux pts/1 :0.0 Sun Dec 10 08:15 - 08:27 (00:11) root pts/0 192.168.253.1 Sun Dec 10 08:15 - down (13:04) nglinux tty1 :0 Sun Dec 10 08:15 - down (13:04) reboot system boot 2.6.32-696.el6.i Sun Dec 10 08:14 - 21:20 (13:05) root pts/5 192.168.253.1 Sun Dec 10 07:52 - down (00:21) root pts/2 192.168.253.1 Sun Dec 10 07:26 - down (00:47) nglinux pts/0 :0.0 Sun Dec 10 07:03 - down (01:10) nglinux tty1 :0 Sun Dec 10 07:03 - down (01:10) root pts/1 192.168.253.1 Sun Dec 10 06:58 - down (01:15) nglinux pts/0 :0.0 Sat Dec 9 23:33 - 07:02 (07:29) nglinux tty1 :0 Sat Dec 9 23:33 - 07:02 (07:29) root pts/4 192.168.253.1 Sat Dec 9 21:36 - down (10:37) root pts/5 :0.0 Sat Dec 9 21:08 - 21:09 (00:00) root pts/4 :0.0 Sat Dec 9 21:08 - 21:09 (00:00) root tty1 :0 Sat Dec 9 21:08 - 21:09 (00:00) nglinux pts/4 :0.0 Sat Dec 9 21:07 - 21:08 (00:00) nglinux tty1 :0 Sat Dec 9 21:07 - 21:08 (00:00) abc tty1 :0 Sat Dec 9 21:04 - 21:04 (00:00) saket tty1 :0 Sat Dec 9 21:02 - 21:04 (00:01) saket tty1 :0 Sat Dec 9 21:00 - 21:00 (00:00) nglinux pts/4 :0.0 Sat Dec 9 20:57 - 21:00 (00:02) nglinux tty1 :0 Sat Dec 9 20:57 - 21:00 (00:03) root pts/3 192.168.253.1 Sat Dec 9 20:47 - down (11:26) root pts/0 192.168.253.1 Sat Dec 9 07:56 - 22:44 (14:47) root pts/2 192.168.253.1 Sat Dec 9 06:09 - 21:49 (15:39) root pts/2 192.168.253.1 Sat Dec 9 06:01 - 06:01 (00:00) root pts/1 192.168.253.1 Sat Dec 9 05:42 - 21:49 (16:06) root pts/0 192.168.253.1 Sat Dec 9 03:52 - 06:49 (02:57) reboot system boot 2.6.32-696.el6.i Sat Dec 9 03:50 - 08:13 (1+04:22) root pts/2 192.168.253.1 Sat Dec 9 01:44 - crash (02:06) root pts/1 192.168.253.1 Sat Dec 9 01:15 - crash (02:35) root pts/0 192.168.253.1 Sat Dec 9 01:07 - crash (02:43) reboot system boot 2.6.32-696.el6.i Sat Dec 9 01:06 - 08:13 (1+07:07) root pts/2 :0.0 Fri Dec 8 22:52 - crash (02:14) root tty1 :0 Fri Dec 8 22:52 - crash (02:14) root pts/0 192.168.253.1 Fri Dec 8 22:43 - crash (02:22) root pts/0 :0.0 Fri Dec 8 22:04 - 22:04 (00:00) root tty1 :0 Fri Dec 8 22:04 - 22:04 (00:00) saket tty1 :0 Fri Dec 8 22:02 - 22:04 (00:01) root pts/1 192.168.253.1 Fri Dec 8 22:00 - crash (03:05) nglinux pts/0 :0.0 Fri Dec 8 22:00 - 22:01 (00:01) nglinux tty1 :0 Fri Dec 8 21:59 - 22:01 (00:01) reboot system boot 2.6.32-696.el6.i Fri Dec 8 21:59 - 08:13 (1+10:14) nglinux tty1 :0 Fri Dec 8 21:41 - down (00:16) root pts/0 192.168.253.1 Fri Dec 8 21:40 - down (00:17) reboot system boot 2.6.32-696.el6.i Fri Dec 8 21:40 - 21:58 (00:18) root pts/0 192.168.253.1 Fri Dec 8 21:36 - down (00:02) reboot system boot 2.6.32-696.el6.i Fri Dec 8 21:36 - 21:39 (00:03) root pts/0 192.168.253.1 Fri Dec 8 21:34 - down (00:01) reboot system boot 2.6.32-696.el6.i Fri Dec 8 21:31 - 21:35 (00:03) root pts/0 192.168.253.1 Fri Dec 8 21:10 - down (00:10) reboot system boot 2.6.32-696.el6.i Fri Dec 8 18:35 - 21:20 (02:44) root pts/1 192.168.253.1 Fri Dec 8 00:53 - crash (17:42) root pts/0 192.168.253.1 Fri Dec 8 00:37 - crash (17:57) root pts/0 192.168.253.1 Thu Dec 7 09:13 - 19:54 (10:41) reboot system boot 2.6.32-696.el6.i Thu Dec 7 06:55 - 21:20 (1+14:25) root pts/2 192.168.253.1 Thu Dec 7 06:07 - down (00:02) root pts/0 192.168.253.1 Thu Dec 7 02:02 - down (04:07) root pts/4 192.168.253.1 Wed Dec 6 21:03 - 03:13 (06:09) root pts/2 192.168.253.1 Wed Dec 6 21:03 - 03:13 (06:09) root pts/2 192.168.253.1 Wed Dec 6 20:58 - 21:03 (00:04) root pts/1 192.168.253.1 Wed Dec 6 04:55 - 01:56 (21:00) root pts/0 192.168.253.1 Wed Dec 6 04:55 - 01:56 (21:00) root pts/0 192.168.253.1 Wed Dec 6 02:22 - 02:22 (00:00) root pts/5 192.168.253.1 Tue Dec 5 22:57 - 06:52 (07:54) root pts/4 192.168.253.1 Tue Dec 5 22:23 - 06:52 (08:28) root pts/2 192.168.253.1 Tue Dec 5 22:13 - 06:52 (08:38) root pts/1 192.168.253.1 Tue Dec 5 21:17 - 00:09 (02:51) root pts/0 192.168.253.1 Tue Dec 5 20:59 - 23:36 (02:37) root pts/3 :0.0 Tue Dec 5 08:09 - down (1+22:00) root tty1 :0 Tue Dec 5 08:08 - down (1+22:01) root pts/2 192.168.253.1 Tue Dec 5 05:16 - 19:42 (14:25) root pts/1 192.168.253.1 Tue Dec 5 00:52 - 09:25 (08:33) root pts/0 192.168.253.1 Tue Dec 5 00:52 - 09:47 (08:55) reboot system boot 2.6.32-696.el6.i Tue Dec 5 00:49 - 06:10 (2+05:21) root pts/1 192.168.253.1 Mon Dec 4 22:06 - crash (02:42) root pts/0 192.168.253.1 Mon Dec 4 21:32 - crash (03:16) root pts/0 192.168.253.1 Mon Dec 4 21:32 - 21:32 (00:00) root pts/0 192.168.253.1 Mon Dec 4 21:03 - 21:03 (00:00) root pts/0 192.168.253.1 Mon Dec 4 19:43 - 19:43 (00:00) root pts/8 192.168.253.1 Mon Dec 4 19:41 - crash (05:07) root pts/7 192.168.253.1 Mon Dec 4 19:34 - crash (05:14) root pts/7 192.168.253.1 Mon Dec 4 11:38 - 11:38 (00:00) root pts/6 192.168.253.1 Mon Dec 4 10:55 - 21:30 (10:35) root pts/5 192.168.253.1 Mon Dec 4 10:43 - 21:30 (10:47) root pts/5 192.168.253.1 Mon Dec 4 06:14 - 06:16 (00:01) root pts/4 192.168.253.1 Mon Dec 4 06:14 - 20:17 (14:03) root pts/3 192.168.253.1 Mon Dec 4 06:13 - 20:17 (14:03) root pts/2 192.168.253.1 Mon Dec 4 04:41 - 19:43 (15:01) root pts/2 192.168.253.1 Sun Dec 3 23:27 - 03:56 (04:29) root pts/1 192.168.253.1 Sun Dec 3 21:50 - 19:43 (21:52) root pts/0 192.168.253.1 Sun Dec 3 21:43 - 19:43 (21:59) reboot system boot 2.6.32-696.el6.i Sun Dec 3 21:38 - 06:10 (3+08:32) root pts/1 192.168.253.1 Sun Dec 3 21:11 - down (00:01) root pts/0 192.168.253.1 Sun Dec 3 17:57 - down (03:16) root pts/5 192.168.253.1 Sun Dec 3 06:35 - down (14:38) root pts/4 192.168.253.1 Sun Dec 3 06:35 - down (14:38) root pts/3 192.168.253.1 Sun Dec 3 06:34 - down (14:38) root pts/1 192.168.253.1 Sun Dec 3 03:12 - 08:32 (05:20) root pts/0 192.168.253.1 Sun Dec 3 02:25 - 08:35 (06:09) root pts/2 192.168.253.1 Sat Dec 2 21:02 - 08:35 (11:33) root pts/4 192.168.253.1 Sat Dec 2 03:13 - 08:27 (05:13) root pts/0 192.168.253.1 Sat Dec 2 03:08 - 21:53 (18:45) root pts/3 192.168.253.1 Fri Dec 1 22:12 - 05:01 (06:49) root pts/3 192.168.253.1 Fri Dec 1 20:49 - 22:12 (01:23) root pts/2 192.168.253.1 Fri Dec 1 20:47 - 05:01 (08:13) root pts/1 :0.0 Fri Dec 1 08:54 - 23:04 (1+14:10) root tty1 :0 Fri Dec 1 08:54 - 23:04 (1+14:10) root pts/0 192.168.253.1 Fri Dec 1 08:52 - 22:43 (13:50) root pts/5 192.168.253.1 Thu Nov 30 19:17 - 20:52 (1+01:34) root pts/4 192.168.253.1 Thu Nov 30 10:04 - 21:13 (11:09) root pts/3 192.168.253.1 Thu Nov 30 10:04 - 21:13 (11:09) root pts/2 192.168.253.1 Thu Nov 30 10:00 - 21:14 (11:14) root pts/1 192.168.253.1 Thu Nov 30 09:14 - 20:35 (11:20) root pts/0 192.168.253.1 Thu Nov 30 06:21 - 19:43 (13:21) root pts/0 192.168.253.1 Thu Nov 30 04:31 - 05:09 (00:38) root pts/1 192.168.253.1 Thu Nov 30 04:07 - 04:21 (00:14) root pts/0 192.168.253.1 Thu Nov 30 03:59 - 04:21 (00:22) reboot system boot 4.14.0-1.el6.elr Thu Nov 30 03:57 - 21:13 (3+17:15) root pts/4 192.168.253.1 Thu Nov 30 03:29 - down (00:19) root pts/3 192.168.253.1 Thu Nov 30 03:28 - down (00:20) root pts/2 :0.0 Thu Nov 30 02:06 - down (01:42) root tty1 :0 Thu Nov 30 02:06 - down (01:42) root pts/1 192.168.253.1 Thu Nov 30 02:03 - down (01:45) root pts/0 192.168.253.1 Thu Nov 30 01:55 - down (01:53) reboot system boot 2.6.32-696.el6.i Thu Nov 30 01:53 - 03:49 (01:55) nglinux tty1 :0 Thu Nov 30 01:23 - crash (00:29) root pts/0 192.168.253.1 Wed Nov 29 21:33 - crash (04:19) reboot system boot 2.6.32-696.el6.i Wed Nov 29 21:16 - 03:49 (06:32) nglinux tty1 :0 Wed Nov 29 19:51 - down (01:12) root pts/2 192.168.253.1 Wed Nov 29 18:39 - down (02:24) root pts/1 192.168.253.1 Wed Nov 29 18:33 - down (02:30) root pts/0 192.168.253.1 Wed Nov 29 17:26 - 20:33 (03:07) nglinux tty1 :0 Wed Nov 29 17:25 - 17:26 (00:00) reboot system boot 4.14.0-1.el6.elr Wed Nov 29 17:25 - 21:03 (03:38) root pts/0 192.168.253.1 Wed Nov 29 17:18 - down (00:06) reboot system boot 4.14.0-1.el6.elr Wed Nov 29 16:48 - 17:24 (00:36) nglinux tty1 :0 Wed Nov 29 09:54 - 09:55 (00:00) reboot system boot 2.6.32-696.el6.i Wed Nov 29 09:54 - 09:55 (00:00) root pts/2 192.168.253.1 Wed Nov 29 09:22 - down (00:30) root pts/1 192.168.253.1 Wed Nov 29 09:19 - down (00:34) root pts/0 192.168.253.1 Wed Nov 29 09:13 - down (00:40) nglinux tty1 :0 Wed Nov 29 09:12 - down (00:40) reboot system boot 4.14.0-1.el6.elr Wed Nov 29 09:12 - 09:53 (00:41) root pts/0 192.168.253.1 Wed Nov 29 09:11 - down (00:00) reboot system boot 2.6.32-696.el6.i Wed Nov 29 09:00 - 09:11 (00:10) root pts/0 192.168.253.1 Wed Nov 29 08:59 - down (00:00) reboot system boot 4.14.0-1.el6.elr Wed Nov 29 08:57 - 08:59 (00:02) root pts/1 :0.0 Wed Nov 29 08:36 - down (00:19) root pts/0 192.168.253.1 Wed Nov 29 08:36 - down (00:19) root tty1 :0 Wed Nov 29 08:36 - down (00:19) reboot system boot 4.14.0-1.el6.elr Wed Nov 29 08:35 - 08:56 (00:20) root pts/1 :0.0 Wed Nov 29 08:29 - down (00:05) root tty1 :0 Wed Nov 29 08:29 - down (00:05) root pts/2 :0.0 Wed Nov 29 05:43 - 05:44 (00:01) root tty1 :0 Wed Nov 29 05:43 - 05:44 (00:01) nglinux tty1 :0 Wed Nov 29 05:42 - 05:43 (00:01) root pts/2 :0.0 Wed Nov 29 05:35 - 05:41 (00:06) root tty1 :0 Wed Nov 29 05:35 - 05:41 (00:06) root pts/1 192.168.253.1 Wed Nov 29 03:17 - 08:21 (05:04) root pts/0 192.168.253.1 Wed Nov 29 03:06 - down (05:28) nglinux tty1 :0 Wed Nov 29 03:05 - 05:35 (02:29) reboot system boot 4.14.0-1.el6.elr Wed Nov 29 03:05 - 08:34 (05:29) root pts/1 192.168.253.1 Wed Nov 29 03:01 - down (00:02) root pts/0 192.168.253.1 Wed Nov 29 02:58 - down (00:05) nglinux pts/0 :0.0 Wed Nov 29 02:58 - 02:58 (00:00) nglinux tty1 :0 Wed Nov 29 02:57 - down (00:06) reboot system boot 2.6.32-696.el6.i Wed Nov 29 02:56 - 03:04 (00:07) nglinux tty1 :0 Wed Nov 29 02:54 - down (00:01) root pts/2 :0.0 Wed Nov 29 02:42 - 02:54 (00:12) root tty1 :0 Wed Nov 29 02:41 - 02:54 (00:12) root pts/1 192.168.253.1 Wed Nov 29 02:40 - down (00:15) nglinux tty1 :0 Wed Nov 29 02:40 - 02:41 (00:01) root pts/1 :0.0 Wed Nov 29 02:24 - 02:40 (00:15) root tty1 :0 Wed Nov 29 02:24 - 02:40 (00:15) nglinux tty1 :0 Wed Nov 29 02:23 - 02:24 (00:01) root pts/1 :0.0 Wed Nov 29 02:22 - 02:23 (00:00) root tty1 :0 Wed Nov 29 02:22 - 02:23 (00:00) nglinux tty1 :0 Wed Nov 29 02:22 - 02:22 (00:00) root pts/0 192.168.253.1 Wed Nov 29 02:21 - down (00:35) reboot system boot 2.6.32-696.el6.i Wed Nov 29 02:19 - 02:56 (00:36) root pts/1 192.168.253.1 Wed Nov 29 02:17 - down (00:00) root pts/1 192.168.253.1 Wed Nov 29 02:16 - 02:17 (00:00) root pts/0 :0.0 Wed Nov 29 02:16 - down (00:02) root tty1 :0 Wed Nov 29 02:16 - down (00:02) reboot system boot 2.6.32-696.el6.i Wed Nov 29 02:15 - 02:18 (00:03) root pts/1 :0.0 Wed Nov 29 01:56 - down (00:17) root tty1 :0 Wed Nov 29 01:56 - down (00:17) root pts/1 :0.0 Tue Nov 28 23:08 - 23:08 (00:00) root tty1 :0 Tue Nov 28 23:08 - 23:08 (00:00) saket tty1 :0 Tue Nov 28 23:07 - 23:07 (00:00) nglinux tty1 :0 Tue Nov 28 23:06 - 23:07 (00:00) root pts/2 192.168.253.1 Tue Nov 28 21:59 - down (04:15) root pts/1 :0.0 Tue Nov 28 21:38 - 23:06 (01:27) root tty1 :0 Tue Nov 28 21:37 - 23:06 (01:28) root pts/0 192.168.253.1 Tue Nov 28 21:01 - down (05:13) reboot system boot 2.6.32-696.el6.i Tue Nov 28 20:57 - 02:14 (05:16) root pts/3 192.168.253.1 Tue Nov 28 20:48 - down (00:06) root pts/2 192.168.253.1 Tue Nov 28 09:03 - down (11:51) root pts/1 192.168.253.1 Tue Nov 28 07:55 - down (12:59) root pts/3 192.168.253.1 Tue Nov 28 07:25 - 07:55 (00:30) root pts/0 192.168.253.1 Tue Nov 28 05:47 - down (15:07) root pts/1 192.168.253.1 Mon Nov 27 22:43 - 07:27 (08:44) root pts/0 192.168.253.1 Mon Nov 27 22:07 - 05:29 (07:21) root pts/2 192.168.253.1 Mon Nov 27 21:13 - 07:28 (10:14) root pts/1 192.168.253.1 Mon Nov 27 09:56 - 22:40 (12:43) root pts/0 192.168.253.1 Mon Nov 27 08:48 - 21:32 (12:44) root pts/0 192.168.253.1 Mon Nov 27 07:37 - 07:45 (00:07) root pts/0 192.168.253.1 Mon Nov 27 05:15 - 05:15 (00:00) root pts/4 192.168.253.1 Sun Nov 26 20:39 - 09:00 (12:21) root pts/3 192.168.253.1 Sun Nov 26 20:38 - 21:32 (1+00:54) root pts/2 192.168.253.1 Sun Nov 26 04:42 - 21:51 (17:08) nglinux tty1 :0 Sun Nov 26 04:41 - down (2+16:13) root pts/1 192.168.253.1 Sun Nov 26 04:06 - 21:51 (17:44) root pts/0 192.168.253.1 Sun Nov 26 03:57 - 21:51 (17:53) reboot system boot 2.6.32-696.el6.i Sun Nov 26 03:57 - 20:54 (2+16:57) saket tty1 :0 Sun Nov 26 03:11 - 03:12 (00:01) nglinux tty1 :0 Sun Nov 26 03:10 - 03:11 (00:01) root pts/1 192.168.253.1 Sun Nov 26 03:07 - crash (00:49) saket tty1 :0 Sun Nov 26 03:05 - 03:09 (00:04) root pts/0 192.168.253.1 Sun Nov 26 03:02 - crash (00:54) saket pts/0 :0.0 Sun Nov 26 03:02 - 03:02 (00:00) saket tty1 :0 Sun Nov 26 03:01 - 03:04 (00:03) reboot system boot 2.6.32-696.el6.i Sun Nov 26 03:00 - 20:54 (2+17:54) nglinux tty1 :0 Sun Nov 26 02:59 - down (00:00) nglinux tty1 :0 Sun Nov 26 02:59 - 02:59 (00:00) root pts/1 192.168.253.1 Sun Nov 26 02:58 - down (00:01) nglinux tty1 :0 Sun Nov 26 02:58 - 02:58 (00:00) root pts/0 192.168.253.1 Sun Nov 26 02:56 - down (00:03) nglinux tty1 :0 Sun Nov 26 02:55 - 02:57 (00:02) reboot system boot 2.6.32-696.el6.i Sun Nov 26 02:55 - 02:59 (00:04) root pts/2 192.168.253.1 Sun Nov 26 02:52 - down (00:01) root pts/1 192.168.253.1 Sun Nov 26 02:16 - down (00:38) root pts/0 192.168.253.1 Sun Nov 26 01:41 - down (01:12) nglinux tty1 :0 Sun Nov 26 01:40 - 02:54 (01:13) reboot system boot 2.6.32-696.el6.i Sun Nov 26 01:40 - 02:54 (01:14) root pts/1 :0.0 Sun Nov 26 01:34 - down (00:04) root tty1 :0 Sun Nov 26 01:33 - down (00:05) nglinux tty1 :0 Sun Nov 26 01:30 - 01:33 (00:03) root pts/0 192.168.253.1 Sun Nov 26 01:24 - down (00:14) reboot system boot 4.14.0-1.el6.elr Sun Nov 26 01:23 - 01:39 (00:15) root pts/0 192.168.253.1 Sun Nov 26 01:20 - down (00:02) reboot system boot 4.14.0-1.el6.elr Sun Nov 26 01:19 - 01:23 (00:03) root pts/1 192.168.253.1 Sat Nov 25 23:57 - down (01:21) root pts/0 192.168.253.1 Sat Nov 25 23:56 - down (01:22) reboot system boot 2.6.32-696.el6.i Sat Nov 25 23:50 - 01:18 (01:28) root pts/0 192.168.253.1 Sat Nov 25 23:46 - down (00:03) reboot system boot 2.6.32-696.el6.i Sat Nov 25 23:45 - 23:49 (00:04) root pts/0 192.168.253.1 Sat Nov 25 23:34 - down (00:05) reboot system boot 2.6.32-696.el6.i Sat Nov 25 23:34 - 23:40 (00:06) root pts/0 192.168.253.1 Sat Nov 25 23:24 - down (00:07) saket tty1 :0 Sat Nov 25 23:24 - down (00:07) saket tty1 :0 Sat Nov 25 23:23 - 23:24 (00:00) reboot system boot 2.6.32-696.el6.i Sat Nov 25 23:23 - 23:32 (00:08) root pts/0 192.168.253.1 Sat Nov 25 23:20 - down (00:02) reboot system boot 2.6.32-696.el6.i Sat Nov 25 23:18 - 23:22 (00:04) root pts/1 192.168.253.1 Sat Nov 25 22:56 - down (00:21) root pts/0 192.168.253.1 Sat Nov 25 22:04 - down (01:12) reboot system boot 2.6.32-696.el6.i Sat Nov 25 22:04 - 23:17 (01:13) root pts/1 192.168.253.1 Sat Nov 25 21:52 - down (00:11) root pts/0 192.168.253.1 Sat Nov 25 21:51 - down (00:12) reboot system boot 2.6.32-696.el6.i Sat Nov 25 21:50 - 22:03 (00:12) root pts/0 192.168.253.1 Sat Nov 25 21:45 - down (00:04) reboot system boot 2.6.32-696.el6.i Sat Nov 25 21:44 - 21:49 (00:05) root pts/1 192.168.253.1 Sat Nov 25 21:43 - down (00:00) root pts/0 192.168.253.1 Sat Nov 25 21:38 - down (00:05) reboot system boot 2.6.32-696.el6.i Sat Nov 25 21:37 - 21:43 (00:06) reboot system boot 4.14.0-1.el6.elr Sat Nov 25 21:36 - 21:43 (00:07) root pts/0 192.168.253.1 Sat Nov 25 21:30 - down (00:04) reboot system boot 2.6.32-696.el6.i Sat Nov 25 21:29 - 21:35 (00:05) root pts/0 192.168.253.1 Sat Nov 25 21:26 - down (00:02) saket tty1 :0 Sat Nov 25 21:25 - 21:26 (00:00) reboot system boot 2.6.32-696.el6.i Sat Nov 25 21:24 - 21:29 (00:04) root pts/0 192.168.253.1 Sat Nov 25 21:17 - down (00:06) reboot system boot 2.6.32-696.el6.i Sat Nov 25 21:17 - 21:24 (00:07) wtmp begins Sat Nov 25 21:17:15 2017 [root@nglinux ~]#
2. Get login history for a specific user.
[root@nglinux ~]# last nglinux nglinux pts/3 :0.0 Thu May 30 19:24 still logged in nglinux pts/2 :0.0 Thu May 30 19:24 still logged in nglinux pts/1 :0.0 Thu May 30 19:24 still logged in nglinux pts/0 :0.0 Thu May 30 19:24 still logged in nglinux tty1 :0 Thu May 30 19:23 still logged in nglinux pts/4 :0.0 Thu Dec 14 22:38 - 22:38 (00:00) nglinux pts/3 :0.0 Thu Dec 14 22:38 - 22:38 (00:00) nglinux pts/2 :0.0 Thu Dec 14 22:38 - 22:38 (00:00) nglinux pts/1 :0.0 Thu Dec 14 22:38 - 22:38 (00:00) nglinux tty1 :0 Thu Dec 14 22:37 - 22:39 (00:01) nglinux pts/1 :0.0 Thu Dec 14 22:33 - 22:33 (00:00) nglinux pts/1 :0.0 Thu Dec 14 22:32 - 22:32 (00:00)
3. How to take backup of user logged in history data.
a. Copy below wtmp file
[root@nglinux log]# ls -l /var/log | grep -i wtmp -rw-rw-r--. 1 root utmp 445056 May 30 20:13 wtmp [root@nglinux log]# cp -p /var/log/wtmp /root/wtmp.backup [root@nglinux log]#
b. Now read it like below.
[root@nglinux log]# last -f /root/wtmp.backup root pts/5 172.21.49.223 Thu May 30 20:13 still logged in root pts/4 172.21.49.223 Thu May 30 19:25 still logged in nglinux pts/3 :0.0 Thu May 30 19:24 still logged in nglinux pts/2 :0.0 Thu May 30 19:24 still logged in
4. Increase wtmp copies in logrotate configuration
[root@nglinux log]# cat /etc/logrotate.conf | grep -iA 5 wtmp
# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
monthly
create 0664 root utmp
minsize 1M
rotate 1
}
We can change rotate 1 to rotate 5 to keep 5 backup copies of wtmp file data.