How to check past login user information in Linux

Linux method to view past login user information: 1. Use the last command to view relevant information about current and past login system users, the syntax is "last [option]"; 2. Use the lastlog command to view login information past the last login time of the current system user. The last command reads the "/var/log/wtmp" log file by default, and the lastlog command reads the "/var/log/lastlog" file by default. Both files are binary files and cannot be edited directly with vi.

linux View past login user information

In Linux, you can use the w or who command to view the user information currently logged in to the system, but If the user who originally logged in has now logged out, can he still view it? Of course, this requires using the last and lastlog commands.

linux last command

The last command can view relevant information about current and past users who have logged in to the system; the

last command The basic format is as follows:

[root@localhost ~]# last [选项]

Table 1 lists the commonly used options and meanings of this command.

##- aDisplay the host name or IP address from where you log in to the system on the last line. -RDoes not display the host name or IP address for logging into the system. -xDisplays information such as system shutdown, restart, and execution level changes. -n Display number of columns Set the number of display columns for listing information. -dConvert the displayed IP address to a host name.

Table 1 Common options and meanings of last command

Options	Meaning

When executing the last command, it will read the /var/log/wtmp log file by default. This is a binary file and cannot be edited directly with vi. It can only be edited through last command is called.

Example: Query current and past logged in user information

[root@localhost ~]# last
root pts/0 192.168.0.108 Fri Jun 7 09：53 still logged in
root tty1 Fri Jun 7 09：53 still logged in
root pts/0 192.168.0.101 Fri Jun 7 06：53 - 09：52 (02：59)
root pts/1 192.168.0.103 Fri Jun 7 04：12 - 04：30 (00：18)
#用户名 登录终端 登录IP 登录时间 - 退出时间（在线时间）
reboot system boot 2.6.32-279.el6.i Thu Jun 6 23：53 - 00：03 (00：09)
#还能看到系统的重启时间
…省略部分输出…

linux lastlog command

The lastlog command can view the last time each system user logged into the system. For example:

[root@localhost ~]#lastlog
#用户名        端口    来自                最后登陆时间
Username    Port   From                Latest
root             pts/1  192.168.1.100  Wed Mar  4 11:04:22 +0800 2009
bin                                                  **Never logged in**
....(中间省略)....
vbird1          pts/2  192.168.1.100  Wed Mar  4 13:15:56 +0800 2009
....(以下省略)....

The lastlog command defaults to reading the /var/log/lastlog log file. This file is also a binary file and cannot be edited directly with vi. It needs to be called with the lastlog command.

Related recommendations: "

Linux Video Tutorial"

The above is the detailed content of How to check past login user information in Linux. For more information, please follow other related articles on the PHP Chinese website!