18

As I know, the last command shows recent logins by all users. But my PC (CentOS) has been used for roughly a year, and there are many users logged. I tried to used the last command, but it just showed from June 2013 to September 2013.

My question is: how can I show the latest users that have logged in recently, say (December 2013 through Jan 2014)?

  • Could you check if the /var/log/wtmp file is present and its last change time using stat. – mkc Jan 9 '14 at 2:46
  • Also, note that the latest entries in the output of the last command would be at the top. – mkc Jan 9 '14 at 2:56
  • anyway to make it down to the bottom? – Thomas Jan 9 '14 at 2:57
  • 1
    Try last | tac – mkc Jan 9 '14 at 2:59
  • 1
    just do a stat: stat /var/log/wtmp – mkc Jan 9 '14 at 2:59
14

last reads from a log file, usually /var/log/wtmp and prints the entries of successful login attempts made by the users in the past. The output is such that the last logged in users entry appears on top. In your case perhaps it went out of notice because of this.

In order to check when was the file /var/log/wtmp was written last, you can use stat command:

stat /var/log/wtmp

In order to print the output in reverse, you can pipe output of last to GNU tac (opposite of cat) as follows:

last | tac
15

You can also use the command lastlog command on Linux. It gives you more granular controls as to ranges of dates when looking through the logs of user logins.

excerpt from lastlog man page

   lastlog - reports the most recent login of all users or of a given user

Example

To find out the users that have logged into a system in the last 100 days.

$ lastlog -b 0 -t 100
Username         Port     From             Latest
sam              pts/0    pegasus          Wed Jan  8 20:32:25 -0500 2014
joe              pts/0    192.168.1.105    Thu Dec 12 12:47:11 -0500 2013

This shows that the last times these users logged into this system. The range of time shows the last 100 days. Before today (-b 0) and after 100 days ago (-t 100).

You can also show all the users by omitting any range and just seeing every usre that's ever logged in, and the last time they logged in.

0

You can try this script:

for user in $( awk -F: '{ print $1}' /etc/passwd)
do
lastlog=$(sudo lsuser -a time_last_login $user | awk -F'=' '{print $NF}')
echo "$user         \c"; perl -le "print scalar localtime($lastlog);"
done
  • 1
    Welcome to Unix.SE. Could you explain what advantages this approach has over the existing answers, if any? – Stephen Kitt Feb 6 '18 at 12:36
  • this script will give last log timestamp for all users in UNIX (AIX) – user266746 Aug 17 '18 at 12:22
  • Thanks for the info; please edit your answer to mention that. Note too that the question is about CentOS, not AIX. – Stephen Kitt Aug 17 '18 at 12:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.