The "last" command provides some easy ways to see who has been logging into your system and when, but with a little more work, you can ask it to report on a specific time period. Credit: Liz Jones The last command provides an easy way to review recent logins on a Linux system. It also has some useful options –- such as looking for logins for one particular user or looking for logins in an older wtmp file. The last command with no arguments will easily show you all recent logins. It pulls the information from the current wtmp (/var/log/wtmp) file and shows the logins in reverse sequential order (newest first). $ last shs pts/1 192.168.0.15 Mon Mar 19 17:48 still logged in shs tty2 /dev/tty2 Mon Mar 19 17:37 still logged in shs pts/2 192.168.0.15 Mon Mar 19 17:22 - 17:23 (00:00) jdoe pts/3 192.168.0.15 Mon Mar 19 16:51 - 17:22 (00:31) To look for logins for just one particular user, supply their username as an argument. $ last jdoe If you’d like for everyone with an account on your server to see their recent logins when they log in, you could add a command like “last $USER” or “last -n 10 $USER” to one of their dot files (e.g., .bash_profile). echo Your recent logins: last -n 10 $USER If you want to look further back, the last command allows you to paw through any previous wtmp files on your system. You just have to specify the name of the wtmp file (e.g., /var/log/wtmp.1). $ last -f /var/log/wtmp.1 jdoe Note that the previous wtmp file on your system may not be wtmp.1. Some systems name the older files using date stamps like wtmp-2018-01-02. Check /var/log before you rely on the command shown above. If you want to do something more complicated, you will need to do a little more work. For example, say you want to show logins for some particular period of time and you want to span both the current and previous (rotated) wtmp file. You could use a script like this one: #!/bin/bash echo -n "Start date: (e.g., Mar 1): " read start echo -n "End date: (e.g., Mar 11): " read end last | grep -v wtmp | while read line do date=`date -d "$(echo $line | awk '{ print $5" "$6" "$7 }')" +%s` [[ $date -ge `date -d "$start 00:00" +%s` && $date -le `date -d "$end 23:59" +%s` ]] && echo $line done last -f /var/log/wtmp.1 | grep -v wtmp | while read line do date=`date -d "$(echo $line | awk '{ print $5" "$6" "$7 }')" +%s` [[ $date -ge `date -d "$start 00:00" +%s` && $date -le `date -d "$end 23:59" +%s` ]] && echo $line done This script prompts for the beginning and end dates for your search and provides examples of the required format. It then runs the last command using a simple filter to allow it to ignore the “wtmp begins” message that lets you know how far back you are searching. It then takes the date from each line and converts it to the “seconds since Jan 1st, 1970 UTC” format. Next, it compares each record to the range of dates we’re looking for (also converted to the same format) and prints those that fall in between those two dates. The second loop, added to allow it to also search through the wtmp.1 file, can be easily removed if it isn’t needed. It uses the same commands once it’s looping through the output of the last command for the second file. No checking is being done within this script to ensure that anyone running it has provided the dates in the required format. Making this mistake will, however, only generate a downpour of “invalid date” commands and won’t otherwise ruin your day. Related content how-to Backgrounding and foregrounding processes in the Linux terminal Running processes in the background can be convenient when you want to use your terminal window for something else while you wait for the first task to complete. By Sandra Henry-Stocker May 24, 2024 5 mins Linux how-to Making a case for case statements on Linux Case statements can allow you to simplify the logic of your scripts. By Sandra Henry-Stocker May 22, 2024 4 mins Linux how-to Compressing files using the zip command on Linux The zip command lets you compress files to preserve them or back them up, and you can require a password to extract the contents of a zip file. By Sandra Henry-Stocker May 13, 2024 4 mins Linux opinion NSA, FBI warn of email spoofing threat Email spoofing is acknowledged by experts as a very credible threat. By Sandra Henry-Stocker May 13, 2024 3 mins Linux PODCASTS VIDEOS RESOURCES EVENTS NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe