Home > Article > Operation and Maintenance > How to check past login user information in Linux
Linux method to view past login user information: 1. Use the last command to view relevant information about current and past login system users, the syntax is "last [option]"; 2. Use the lastlog command to view login information past the last login time of the current system user. The last command reads the "/var/log/wtmp" log file by default, and the lastlog command reads the "/var/log/lastlog" file by default. Both files are binary files and cannot be edited directly with vi.
linux View past login user information
In Linux, you can use the w or who command to view the user information currently logged in to the system, but If the user who originally logged in has now logged out, can he still view it? Of course, this requires using the last and lastlog commands.
linux last command
The last command can view relevant information about current and past users who have logged in to the system; the
last command The basic format is as follows:
[root@localhost ~]# last [选项]
Table 1 lists the commonly used options and meanings of this command.
Options | Meaning |
---|---|
Display the host name or IP address from where you log in to the system on the last line. | |
Does not display the host name or IP address for logging into the system. | |
Displays information such as system shutdown, restart, and execution level changes. | |
Set the number of display columns for listing information. | |
Convert the displayed IP address to a host name. |
Example: Query current and past logged in user information
[root@localhost ~]# last root pts/0 192.168.0.108 Fri Jun 7 09:53 still logged in root tty1 Fri Jun 7 09:53 still logged in root pts/0 192.168.0.101 Fri Jun 7 06:53 - 09:52 (02:59) root pts/1 192.168.0.103 Fri Jun 7 04:12 - 04:30 (00:18) #用户名 登录终端 登录IP 登录时间 - 退出时间(在线时间) reboot system boot 2.6.32-279.el6.i Thu Jun 6 23:53 - 00:03 (00:09) #还能看到系统的重启时间 …省略部分输出…
linux lastlog command
The lastlog command can view the last time each system user logged into the system. For example:[root@localhost ~]#lastlog #用户名 端口 来自 最后登陆时间 Username Port From Latest root pts/1 192.168.1.100 Wed Mar 4 11:04:22 +0800 2009 bin **Never logged in** ....(中间省略).... vbird1 pts/2 192.168.1.100 Wed Mar 4 13:15:56 +0800 2009 ....(以下省略)....The lastlog command defaults to reading the /var/log/lastlog log file. This file is also a binary file and cannot be edited directly with vi. It needs to be called with the lastlog command. Related recommendations: "
Linux Video Tutorial"
The above is the detailed content of How to check past login user information in Linux. For more information, please follow other related articles on the PHP Chinese website!