Linux Tutorial

Linux File/Directory Management

Linux Packaging And Compression

Vim Text Editor

Linux Text Processing

Linux Software Installation

Linux User/User Group Management

Linux Permission Management

Linux Filesystem Management

Linux Advanced Filesystem Management

Linux System Management

Linux Backup and Recovery

Linux System Service Management

Linux System Log Management

Linux Boot Management

LAMP/LNMP Environment

SELinux Management

Linux last And lastlog Commands: Display Logged In Users Information

The last and lastlog commands in Linux provide information about user logins on a system. They allow administrators to monitor system access and detect unauthorized access attempts. In this tutorial, we'll cover basic usage examples for both the last and lastlog commands.

last command:

The last command displays a list of the most recent user logins, sorted by date and time. It retrieves this information from the /var/log/wtmp file.

Display the login history:
```
last
```
Show a specific number of entries:
To limit the number of displayed entries, use the -n option followed by the number of entries you want to display:
```
last -n 10
```
Show login history for a specific user:
To display the login history for a specific user, simply add the username to the command:
```
last username
```
Show login history since a specific date and time:
To display the login history since a specific date and time, use the -t option followed by the date and time in the format YYYYMMDDhhmm:
```
last -t 202301011230
```

lastlog command:

The lastlog command displays the most recent login information for each user on the system. It retrieves this information from the /var/log/lastlog file.

Display the last login for all users:
```
lastlog
```
Show last login information for a specific user:
To display the last login information for a specific user, use the -u option followed by the username:
```
lastlog -u username
```
Show last login information for users with UID range:
To display the last login information for users with a specific UID range, use the -t option followed by the range of UIDs:
```
lastlog -t UID_min-UID_max
```
For example, to display the last login information for users with UID between 1000 and 2000, run:
```
lastlog -t 1000-2000
```

In summary, the last and lastlog commands in Linux provide valuable information about user logins on a system. By using various options, you can filter the displayed entries, show login history for specific users, and focus on a specific date and time or UID range.

How to use last and lastlog commands in Linux:
The last command displays information about user logins, while lastlog provides details about the last login of users.
Example code (using last):
```
last
```
Example code (using lastlog):
```
lastlog
```
Viewing user login history with last and lastlog:
Both commands provide a history of user logins, showing usernames, terminal, IP addresses, and login times.
Example code:
```
last
lastlog
```
Checking login details for specific users using last:
To view login details for a specific user, use the last command with the username.
Example code:
```
last username
```
Listing the last login times and locations in Linux:
last shows the last login times and locations, including remote IP addresses.
Example code:
```
last -i
```
Viewing failed login attempts with lastlog:
The lastlog command can display information about failed login attempts.
Example code:
```
lastlog --failed
```
Displaying recent login activities with last command:
To view recent login activities, use the last command with the -n option to specify the number of lines.
Example code:
```
last -n 10
```
Filtering lastlog output for specific users in Linux:
Use the lastlog command with the username to filter the output for a specific user.
Example code:
```
lastlog -u username
```
Monitoring user login patterns using last and lastlog:
Regularly check last and lastlog to monitor user login patterns, identify anomalies, and ensure security.