on a redhat server I logged with my domain username, and then switched as root. As I switched as root I received the message for the last login for root (Last login: ....). I am asking if the "last login" message displays the date that every user logged/switched as root, or it displays the date that my username switched as root. The strange thing is that the date displayed for the last login as root was 2 month before the last record in wtmp. Thanks a lot, best of all.

1 Answer 1


You did not elaborate on what exactly you mean by "switched as root". I assume you were using the command su -, possibly in the form sudo su -. As described on its manpage, this command starts a new login shell for the root user. The "last login" message reports the last time a login shell was started for the same user.

In response to your question this means that the "last login" message appearing after su - reports the last time anyone switched to root via su - or logged in directly as root. The same holds for the "last login" message appearing when you log in directly as root.

  • 1
    Hi! I've used the command "sudo su -", it's the same for "su - root", true?
    – Deadalive
    Jun 15, 2021 at 18:15
  • Correct. I have updated my answer to clarify. Jun 15, 2021 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy