How to Check User Login History in Linux Ubuntu

How to check how many users logged in Linux? Know where to check user login logs in Linux and how to check user login history in Linux Ubuntu.

Here is how to check last 10 login and check how many times a user has logged in Linux Ubuntu System.

The Linux Ubuntu login information is stored in three places:

1. /var/log/wtmp – Logs of last login sessions
2. /var/run/utmp – Logs of the current login sessions
3. /var/log/btmp – Logs of the bad login attempts

last Command to Check Last 10 Login

last or lastb command i used to show a listing of last logged in users. The last command searches back through the /var/log/wtmp file (or the file designated by the -f option) and displays a list of all users logged in (and out) since that file was created. One or more usernames and/or ttys can be given, in which case last will show only the entries matching those arguments. Names of ttys can be abbreviated, thus last 0 is the same as last tty0.

The lastb command is the same as last, except that by default it shows a log of the /var/log/btmp file, which contains all the bad login attempts.

last Command Options:

1. – how many lines to show
2. -a, –hostlast display hostnames in the last column
3. -d, –dns translate the IP number back into a hostname
4. -f, –file use a specific file instead of /var/log/wtmp
5. -F, –fulltimes print full login and logout times and dates
6. -i, –ip display IP numbers in numbers-and-dots notation
7. -n, –limit how many lines to show
8. -R, –nohostname don’t display the hostname field
9. -s, –since display the lines since the specified time
10. -t, –until display the lines until the specified time
11. -p, –present display who were present at the specified time
12. -w, –fullnames display full user and domain names
13. -x, –system display system shutdown entries and run level changes
14. –time-format show timestamps in the specified : notime|short|full|iso

If you want to know the last 10 login attempts/actions, you can use the last command with 10. The number 10 represents the no of login to display. In other words, this command options tell last how many lines to show.

who Command

‘who’ command prints information about users who are currently logged on. By default, ‘who’ prints the following information for each user currently logged on: login name, terminal line, login time, and remote hostname or X display.

If given one non-option argument, ‘who’ uses that instead of a default system-maintained file (often ‘/var/run/utmp’ or ‘/etc/utmp’) as the name of the file containing the record of users logged on. ‘/var/log/wtmp’ is commonly given as an argument to ‘who’ to look at who has previously logged on.

If given two non-option arguments, ‘who’ prints only the entry for the user running it (determined from its standard input), preceded by the hostname. Traditionally, the two arguments given are ‘am i’, as in ‘who am i’.

Note that the time stamps are listed according to the time zone rules specified by the ‘TZ’ environment variable, or by the system default rules if ‘TZ’ is not set.