How to tell where recent ssh sessions originated from?

Question

I know that sometimes when I login to systems they print out where the most recent ssh session originated from (usually an ip address or hostname). How can I lookup where some of the most recent ssh logins from my username originated from?

Answer 1

There is a Unix command called last that will list the last times and sources of all the logins to the system. Not all logins make it into the log last looks at. Only logins that end up creating a wtmp entry have that privilege. On Fedora 17 these logins end up being logged in a file named /var/log/wtmp.

Generally most things that create some kind of interactive terminal session generally log to wtmp. Several commands that create such interactive sessions have options for whether or not to create a wtmp entry. For example xterm has the -ls option to force a wtmp entry to be written even if xterm is started to run a command with -e.