2

I'm trying to find out when a user last logged in without using "last". Last relies on the log files which are recycled, after a few weeks, the users' old entries are deleted.

I'm sure there is a per-user entry somewhere that remains retains the information. When I log into some computers for maintenance it always shows my last login time even if it were over a year previously.

Where is the login routine locating this information?

By the way, my main Linux OS is Ubuntu 16.04 LTS. It's my understanding that as of 18.04 there will be significant changes of Ubuntu.

I asked in https://unix.stackexchange.com instead of http://askubuntu.com because I wanted to be sure to have a working resolution, even if this feature changes in the next version. Also, recently I have been studying the Raspberry PI.

The question is about Linux based systems in general.

Example:

I just logged into one of my servers today, March 8, 2018. This is what the login routine shows:

Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-1037-aws x86_64)

78 packages can be updated.
0 updates are security updates.


*** System restart required ***
Last login: Fri Nov  3 02:46:58 2017 from 72.43.238.238

The last log files only go back to February:

$ ls -l /var/log/wtmp*
-rw-rw-r-- 1 root utmp 384 Mar  8 04:36 /var/log/wtmp
-rw-rw-r-- 1 root utmp   0 Feb  1 06:25 /var/log/wtmp.1

Some of the intended tasks include removing inactivate actives users from some of my servers.

9
  • 2
    On a generic Unix system, the log file that last uses is the only place where this information is stored. Specific Unix variants may also store this elsewhere, but since we don't know what Unix you are using we can't guess where this may be.
    – Kusalananda
    Mar 8, 2018 at 9:45
  • last -f /var/log/wtmp.1 you could change your syslog configuration to keep this file longer.
    – Kiwy
    Mar 8, 2018 at 9:50
  • @Kusalananda Thanks. I use a number of Linux distros in my environment. My main OS and main computer is Ubuntu based. But I would like to know how to do this on the Linux based systems in general, if it's possible. I updated the question for clarity on this. Mar 8, 2018 at 10:00
  • @Kiwy The entries are not in /var/log/wtmp.1. The last log files recycle. I believe they only go back two months. As indicated in the question when a user logs in, the login routine will show him the last time he logged in even if it's years previous. I only log into some of my servers a few times a year. It was back in November the last time I logged into my Amazon AWS. The wtmp logs only go back to February. There's something else being used outside of the last command. Mar 8, 2018 at 10:08
  • 1
    If you're an admin on the machine, then you should easily be able to change the rotation of the relevant logs so that much more data is kept.
    – Kusalananda
    Mar 8, 2018 at 10:16

1 Answer 1

4

The command to access this informaion is: lastlog

lastlog - reports the most recent login of all users or of a given user

This uses a database of times of previous user logins. The database is stored in /var/log/lastlog.

Example:

$ lastlog -u apollo
Username         Port     From             Latest
apollo           pts/43   127.0.0.1        Sun Feb 25 04:00:47 -0500 2018

Note:

From test from the output of the command listlog as well as the man pages, the /var/log/laslog database appears to be permanent (has entries from all time). You can access the lastlog entry from anyone in the /etc/passwd file. The lastlog app will report the last login time of the account, or report **Never logged in** if the account has never logged in.

This example entry goes back 6 years ago:

lorenzo          pts/6    ubunzeus         Fri Apr 20 21:23:18 -0400 2012
3
  • 1
    You should state more explicitely that this db is not (and should not be) rotated.
    – user601
    Mar 8, 2018 at 13:15
  • 1
    Thanks! Good idea. I'll add details from the comments under the question to the answer. Mar 9, 2018 at 16:27
  • Can root manipulate the database to make it appear that someone else logged in? Aug 24, 2019 at 1:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .