"Last" command: How to show latest user login?

Question

As I know, the last command shows recent logins by all users. But my PC (CentOS) has been used for roughly a year, and there are many users logged. I tried to used the last command, but it just showed from June 2013 to September 2013.

My question is: how can I show the latest users that have logged in recently, say (December 2013 through Jan 2014)?

Answer 1

You can also use the command lastlog command on Linux. It gives you more granular controls as to ranges of dates when looking through the logs of user logins.

excerpt from lastlog man page

   lastlog - reports the most recent login of all users or of a given user

Example

To find out the users that have logged into a system in the last 100 days.

$ lastlog -b 0 -t 100
Username         Port     From             Latest
sam              pts/0    pegasus          Wed Jan  8 20:32:25 -0500 2014
joe              pts/0    192.168.1.105    Thu Dec 12 12:47:11 -0500 2013

This shows that the last times these users logged into this system. The range of time shows the last 100 days. Before today (-b 0) and after 100 days ago (-t 100).

You can also show all the users by omitting any range and just seeing every usre that's ever logged in, and the last time they logged in.

Answer 2

last reads from a log file, usually /var/log/wtmp and prints the entries of successful login attempts made by the users in the past. The output is such that the last logged in users entry appears on top. In your case perhaps it went out of notice because of this.

In order to check when was the file /var/log/wtmp was written last, you can use stat command:

stat /var/log/wtmp

In order to print the output in reverse, you can pipe output of last to GNU tac (opposite of cat) as follows:

last | tac

Answer 3

You can try this script:

for user in $( awk -F: '{ print $1}' /etc/passwd)
do
lastlog=$(sudo lsuser -a time_last_login $user | awk -F'=' '{print $NF}')
echo "$user         \c"; perl -le "print scalar localtime($lastlog);"
done

Answer 4

lastlog only shows users listed in /etc/passwd, so for lastlog to catch users present in /var/log/wtmp file, in a LDAP server, I used this command:

for u in $(last | awk '{printf $1 "\n" }'| sort  | uniq); lastlog -u $u