last login time of a particular user

[Shivkumar]

Dear Sirs/Madam,

I need to find last login date/time of a user.
How to find this ?

Thanks,
Shiv

[RAC_1]

man last and man lastb
you need last -R|pg

[Indira Aramandla · Accepted solution]

Hi Shivkumar,

use last or lastb command.

The last command searches backwards through the file /var/adm/wtmp which contains a record of all logins and logouts information about a user, a tty, or any group of users and ttys.

Lastb will give you in the lastest date order.

The output will show login username terminal and the date (in format Mon Nov 21 HH:MM)

IA

[Bharat Katkar]

Hi Shiv,
You can use:

# last -R
# lastb -R
# who -R

lastb tells about bad logins whereas last will tell about good logins.
"Who -R" will list all the users logged in alongewith their IP addresses.

Hope that helps.
Regards,

[Borislav Perkov]

Hi Shiv,

#last -R user_name

will show you all the logings for are user_name with the network address for that user_name there you can see the time and duration.

#lastb -R user_name

will show you all bad login attempts of user_name

Regards,
Borislav

[Cem Tugrul]

Shiv,
#last -R username
would be what you want.
Good Luck,

[Yogeeraj_1]

hi,

usage: last [ -number ] [ -f file] [ -R ] [ name ... ] [ tty ... ]

e.g.
# last -R yd
yd ftp myserver.db.mu Thu Aug 11 13:36 - 13:36 (00:00)
yd ftp myserver.db.mu Thu Aug 11 13:29 - 13:29 (00:00)
yd ftp myserver.db.mu Thu Aug 11 13:21 - 13:29 (00:08)
yd ftp myserver.db.mu Thu Aug 11 13:21 - 13:29 (00:08)
yd ftp myserver.db.mu Thu Aug 11 13:20 - 13:29 (00:09)
yd ftp myserver.db.mu Thu Aug 11 13:19 - 13:29 (00:10)


the second column would indicate the type of connection initiated: ftp or telnet (in most cases here)

hope this helps too!
kind regards
yogeeraj

[Frank de Vries]

Use the last command as was said before:)

How does it work,
it is build from /etc/utmp.

a raw view can be done with strings /etc/utmp
and /etc/wtmp for hostnames

hopefully this in-depth info is usefull

[James R. Ferguson]

Hi Shiv:

If the file '/var/adm/wtmp' doesn't exist, no logging will occur. Similarly, you can enable (or not) "bad" login accounting by creating (touching) '/var/adm/btmp'.

'/var/adm/wtmp' may be made readable by anyone, BUT do not make '/var/adm/bwtmp' readable by anyone but root since it is possible that user passwords may be present in 'btmp' from bundlged login attempts.

These files grow without bounds and must be periodically trimmed. One way is to simply null them:

# cat /dev/null > /var/adm/wtmp

The files are binary files and cannot be manipulated with normal text-handling tools. If you want to preserve some contents, you must convert the binary file to an ASCII file; edit (delete) what you don't want; and convert the ASCII file back to the binary format:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

...edit; and then...

# /usr/sbin/acct/fwtmp -ic < /tmp/wtmp > /var/adm/wtmp

You can do the same for the 'btmp' data.

Regards!

...JRF...

[Raj D.]

Hi Shiv,

Here is is :

# last -R | grep "username" | head -n 10

Will show a particular user loggedin for how much time and when. And will show last 10 entry.

You can also find out , from who -R or who -u , the current users logged in.

/var/adm/wtmp keeps the log.

Cheers,
Raj.