How to check user login history on Linux Ubuntu command line? Here’s how to check user activity log in Linux.
Note that the login information of any Linux Ubuntu System is stored in three places:
- /var/log/wtmp – information logs of recent login sessions
- /var/run/utmp – information logs of current login sessions
- /var/log/btmp – information logs of failed login attempts
1. View the history of all logged in users.
To view the history of all successful logins on your system, simply use the Last command.
last
2. View the login history of a specific user.
If you want to see the login information of only the selected user, add the username as the last command.
last <username>
3. How to check a specific number of inputs?
If a lot of people are using the system and you want to see a specific number of logins, use the last command with the number of logins to see:
$last -[X]
Simply replace “X” with the number of logins you want to display.
Team W: The w command is used to show who is logged in and what they are doing. w displays information about the users currently on the computer and their processes. The header shows, in this order, the current time, how long the system has been running, the number of users currently logged on, and system load averages for the last 1, 5, and 15 minutes.
The following entries are displayed for each user:
- login
- terminal name
- remote host
- login time
- downtime
- JCPU and PKPU
- current process command line
You can also use Who is in command? It prints information about users who are currently logged in. If the command does not specify a non-option argument, “who” prints the following information for each user currently logged on:
- login
- end line
- login time
- remote hostname or X mapping
If you want to see the date and time the system was last booted, run the who command with the “–boot” argument.
