Skip to content

Check last successful/failed login user in Linux

homepage-banner

Introduction

In Linux, it’s important to keep track of user logins for security purposes. Sometimes, you may need to check the last successful or failed login for a user. In this blog post, we will discuss three ways to check the last successful/failed login user in Linux.

View current system login users

w
who

Check successful login history records

The last command is used to display a log of all successful and unsuccessful logins for a user. To check the last successful login for a user, run the following command:

last -n

Check history records of failed login attempts

lastb -n

Display login information for each user

The lastlog command is used to display recent login information for all users. It reads from the /var/log/lastlog file, which contains the last login information for each user. To check the last successful login user, run the following command:

lastlog

utmpdump /var/log/wtmp

who /var/log/wtmp

Conclusion

Checking the last successful/failed login user in Linux is an important security measure that can help identify unauthorized access to the system. By using the last and lastb commands, you can easily check the login history of all users or a specific user. Keep in mind that this information is only available for a limited time and may not be available if the logs have been cleared. By following the steps outlined in this blog post, you can easily check the last successful/failed login user in Linux.

Small world. Big idea!
  • Welcome to visit the knowledge base of SRE and DevOps!
  • License under CC BY-NC 4.0
  • No personal information is collected
  • Made with Material for MkDocs and generative AI tools
  • Copyright issue feedback me#imzye.com, replace # with @
  • Get latest SRE news and discuss on Discord Channel