monitoring logins

[Chris Conrad]

How can I get a list of who has logged in over the last 30 days?

[Patrick Wallek · Accepted solution]

Have a look at the 'last' command. 'man last' for more information.

If you want to see invalid logins look at 'lastb'. 'man lastb' for more information.

[Chris Conrad]

Thanks Patrick. That's all I needed to know.

[Bill Hassell]

Note that last (and lastb) have several options to select the users and number of login entries. Note that the datafiles (/var/adm/wtmp and /var/adm/btmp) will grow without bounds and do not have a year stored so these files must be trimmed to less than 11 months of data. But on busy systems, these logs may grow so rapidly that monthly trimming may be needed.