Checking a user's login history
The user's login history will be output to the /var/run/utmp and /var/log/wtmp files.
This file, like the /var/log/lastlog and /var/log/btmp files, is a binary file, so it cannot be displayed by the less, cat, or tail commands.
To display it, use the dedicated /usr/bin/last command.
| [root@Lion ~]# last tama pts/0 192.168.0.162 Wed Oct 10 12:21 still logged in reboot system boot 2.6.32-279.el6.i Wed Oct 10 12:20 - 12:37 (00:17) root tty1 Fri Aug 24 13:45 - down (00:00) tama ftpd1456 192.168.0.162 Fri Aug 24 13:43 - 13:44 (00:01) tama ftpd1455 192.168.0.162 Fri Aug 24 13:43 - 13:44 (00:01) tama ftpd1446 192.168.0.162 Fri Aug 24 13:42 - down (00:03) |
Display login history by specifying a user name.
By specifying a user name as an argument, you can view the login history of a specific user.
| [root@Lion ~]# last tama tama pts/0 192.168.0.162 Wed Oct 10 12:21 still logged in tama ftpd1456 192.168.0.162 Fri Aug 24 13:43 - 13:44 (00:01) tama ftpd1455 192.168.0.162 Fri Aug 24 13:43 - 13:44 (00:01) tama ftpd1446 192.168.0.162 Fri Aug 24 13:42 - down (00:03) |