lastlog

reports recent logins

Reports the most recent login information for a single user, a range of UIDs or all users.,

lastlog [options]

Displays the login-name, port, host and last login time from /var/log/lastlog sorted by their order in /etc/passwd.

Username         Port     From             Latest
root             tty1                      Sat Sep  3 12:41:13 -0400 2022
pi               pts/0    192.168.1.23     Fri Jun 21 08:30:59 -0400 2019
dgerman          pts/1    192.168.1.161    Wed Jul 12 16:48:15 -0400 2023

`-b --before DAYS`	output entries older than `DAYS`.
`-t --time DAYS`	output entries more recent than `DAYS`..
`-u --user login\|range`	output the entry of user(s). Users can be specified by login name, numerical user ID, a min- max range a or a min- or -max .
`-h --help`	Display help message and exit.

If the user has never logged in ** Never logged in** will be displayed.

Only entries for current users will be displayed, entries may exist for deleted users .

Do not rotate /var/log/lastlog.
It is a sparse file, its size is much smaller than shown by ls -l Display its real size with ls -s.

ls -log ll
-rw-rw-r-- 1 292292 Jul 12 16:48 ll
> ls -s ll
20 ll

Files

/var/log/lastlog Database times of previous user logins.

00000000  a9 83 13 63 74 74 79 31  00 00 00 00 00 00 00 00  |...ctty1........|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 36 a1 01  58 36 a1 01 58 36 a1 01  |.....6..X6..X6..|
00000030  58 36 a1 01 74 36 a1 01  ff ff ff ff 58 36 a1 01  |X6..t6......X6..|
00000040  ff ff ff ff 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 28 52 e8 b6  05 00 00 00 1d 00 00 00  |....(R..........|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 38 00 00 00  05 00 00 00 38 00 00 00  |....8.......8...|
00000080  5b 00 00 00 6e 00 00 00  77 00 00 00 7c 00 00 00  |[...n...w...|...|
00000090  5b 00 00 00 6e 00 00 00  77 00 00 00 94 57 e8 b6  |[...n...w....W..|
000000a0  1d 00 00 00 3c 99 ed b6  90 66 a1 01 00 50 e8 b6  |....<....f...P..|
000000b0  08 06 a1 01 0b 00 00 00  01 00 00 00 70 b3 db b6  |............p...|
000000c0  08 06 a1 01 00 00 00 00  c8 6a a1 01 58 36 a1 01  |.........j..X6..|
000000d0  1d 00 00 00 00 00 00 00  c0 43 a0 01 c0 43 a0 01  |.........C...C..|
000000e0  58 36 a1 01 58 d6 91 be  34 c5 ed b6 ff ff ff ff  |X6..X...4.......|
000000f0  08 06 a1 01 0b 00 00 00  01 00 00 00 1c 9b ed b6  |................|
00000100  08 06 a1 01 0b 00 00 00  f0 8c 02 00 90 66 a1 01  |.............f..|
00000110  90 66 a1 01 c0 43 a0 01  00 00 00 00 00 00 00 00  |.f...C..........|
00000120  14 de ae b6 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000130  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00023b70  00 00 00 00 8f 11 af 64  70 74 73 2f 31 00 00 00  |.......dpts/1...|
00023b80  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00023b90  00 00 00 00 00 00 00 00  31 39 32 2e 31 36 38 2e  |........192.168.|
00023ba0  31 2e 31 36 31 00 00 00  00 00 00 00 00 00 00 00  |1.161...........|
00023bb0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000474a0  03 ce 0c 5d 70 74 73 2f  30 00 00 00 00 00 00 00  |...]pts/0.......|
000474b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000474c0  00 00 00 00 31 39 32 2e  31 36 38 2e 31 2e 32 33  |....192.168.1.23|
000474d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000475c4
pi93graf:/home/dgerman > wc ll
     0      4 292292 ll
> lastlog
/usr/bin/lastlog
Username         Port     From             Latest
root             tty1                      Sat Sep  3 12:41:132022
pi               pts/0    192.168.1.23     Fri Jun 21 08:30:592019
dgerman          pts/1    192.168.1.161    Wed Jul 12 16:48:152023

Caveats

Large gaps in UID numbers will cause lastlog to run longer with no output
(Exampole if lastlog contains no entries for users with UID between 170 and 800 lastlog will appear to hang as it processes entries with UIDs 171-799).

Referenced By : aulastlog(8)