How to Check Linux Login History

• Using the last command: The last command shows a list of all the users who have logged into the system, including the time and date of their last login. The command can be run as root or with sudo privileges.

1. Show recent logins: The simplest use of the last command is to display a list of recent logins to the system. The command is run as follows:

2. Show the login history of a specific user: To show the login history of a specific user, add their username after the last command. For example:

3. Show logins and logouts: By default, the last command only shows logins. To also show logouts, use the -f option. For example:

4. Show a specific number of logins: To show a specific number of logins, use the -n option followed by the number of logins you want to see. For example:

5. Show the IP addresses used for remote logins: To see the IP addresses used for remote logins, use the -i option. For example:

6. Show the hostnames used for remote logins: To see the hostnames used for remote logins, use the -R option. For example:

7. Show logins and system reboots: To show logins and system reboots, use the -x option. For example:

8. Show the reverse order of logins: To show the logins in reverse order, use the -r option. For example:

9. Show logins and system shutdowns: To show logins and system shutdowns, use the -a option. For example:

10. Show logins for a specific period of time: To show logins for a specific period of time, use the -t option followed by the desired time range. For example:

Note: Replace YYYYMMDDHHMMSS with the desired start time in the format of year, month, day, hour, minute, and second.

•  Using the lastlog command: The lastlog command shows the last time a user logged into the system. To view the login history of all users, run the command with the -a option.
• Using the w command: The w command shows information about the currently logged in users, including their login time, the time they have been idle, and the command they are currently running.
• Viewing the log files: The log files in the /var/log directory also contain information about user logins and logouts. The log file /var/log/wtmp keeps a record of all logins and logouts, and the /var/log/secure file contains information about authentication events, including successful and failed logins.
• Using the faillog command: The faillog command shows the number of failed login attempts for each user on the system. This can be useful in detecting unauthorized access attempts.