Users

[Marco Hernandez_1]

Is there any quick command that shows you when was the last login of an user, any other than finger?

[Kofi ARTHIABAH]

Try

#last | grep username | tail -1

where username is the username you want to find out about and of course the tail can be changed if you want to find out more than the last time!

cheers.

[James R. Ferguson]

Marco:

Most directly:

# last -1

will return the last (most recent) one (1) logon, directly. See man last.

last -2 root would return the last 2-logins for root.

...JRF...

[Bill Hassell]

last is a great tool for every user. A good technique is to put something like this at the end of .profile:

last -R $(/usr/bin/whoami) 5

This shows not only your last 5 logins but also the hostname (or IP address if it cannot be resolved). This is quite useful in case an unexpected login is seen when you login.

[Rick Garland]

Much as everybody has said, use the last command.

Many neat scripts can be developed using the command and it alows you to keep an eye on who is logged in and when.

[James R. Ferguson]

Hi:

BTW, 'last' presents output by searching backwards through /var/adm/wtmp. Thus the most recent sessions are presented first.

'blast' works similarly to 'last' but returns bad logins. blast uses /var/adm/btmp.

Both wtmp and btmp grow without bound and should be periodically trimmed with SAM or by cat /dev/null > /var/adm/[w|b]tmp

If you don't want logins and/or bad logins tracked, then remove the corresponding file. This will disarm the tracking.

...JRF...

[Trevor Dyson]

Hi,

I go with the suggestions in the previous posts.

Just be careful not to let the /var/adm/wtmp files to grow too large or the last command will take a while to run and if running this from the user's .profile they may see a significant pause before they are able to log in ( saw this on a 4 way T500 with ~400 users)

Regards, Trevor Dyson