Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to know all the times a user logs since last year into my system?
I used last command but it is not useful.

share|improve this question

closed as unclear what you're asking by slm, strugee, Anthon, jasonwryan, peterph Apr 11 at 9:59

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

    
welcome to Stack Exchange! please remember that we're all volunteers here. as such, we expect that you've done some basic research. it looks like you have a start - since you mention trying the last command - but you should be doing more research than that, and in any case, you haven't actually specified why the last command isn't useful. also, define "logged in". do you want to track console logins? SSH logins? Emacs forbid, telnet logins? or just anything authenticating with PAM? be specific. –  strugee Apr 11 at 6:38

2 Answers 2

It seems last can be used to achieve what you are trying to do. You need to append the date to the last command to extract the information.

last | while read line; do date=`date -d "$(echo $line | awk '{ print $5" "$6" "$7 }')" +%s`; [[ $date -ge `date -d "Aug 25 00:00" +%s` && $date -le `date -d "Aug 28 00:00" +%s` ]] && echo $line; done

However, if you are concerned with finding information about a particular user, you can modify the last command as last username and then pipe the while loop to it. It would give you the information of a particular user's login information for the last one year.

I tested the above command and it works perfectly fine in my system. I took the above command from here.

You can change the date in the command to suit your requirements.

share|improve this answer

The login logs on redhat-style linux are called wtmp (man wtmp), stored in /var/log/ by default, and you can retrieve them using utmpdump (on rhel6).

[root@server ~]# utmpdump /var/log/wtmp* | awk '$4~"root" {print}'
Utmp dump of /var/log/wtmp
[7] [01320] [ts/0] [root    ] [pts/0       ] [192.168.1.101       ] [192.168.1.101  ] [Tue Sep 24 00:31:47 2013 UTC]
[7] [01817] [ts/3] [root    ] [pts/3       ] [192.168.1.101       ] [192.168.1.101  ] [Tue Sep 24 00:38:22 2013 UTC]
[7] [01690] [ts/0] [root    ] [pts/0       ] [192.168.1.101       ] [192.168.1.101  ] [Tue Sep 24 00:59:04 2013 UTC]
[7] [23641] [ts/0] [root    ] [pts/0       ] [192.168.1.101       ] [192.168.1.101  ] [Wed Sep 25 19:12:44 2013 UTC]
[7] [03020] [ts/0] [root    ] [pts/0       ] [192.168.1.100       ] [192.168.1.100  ] [Fri Sep 27 21:33:40 2013 UTC]
...
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.