Check last successful/failed login user in Linux
Introduction
In Linux, it’s important to keep track of user logins for security purposes. Sometimes, you may need to check the last successful or failed login for a user. In this blog post, we will discuss three ways to check the last successful/failed login user in Linux.
View current system login users
w
who
Check successful login history records
The last command is used to display a log of all successful and unsuccessful logins for a user. To check the last successful login for a user, run the following command:
last -n
Check history records of failed login attempts
lastb -n
Display login information for each user
The lastlog command is used to display recent login information for all users. It reads from the /var/log/lastlog file, which contains the last login information for each user. To check the last successful login user, run the following command:
lastlog
utmpdump /var/log/wtmp
who /var/log/wtmp
Conclusion
Checking the last successful/failed login user in Linux is an important security measure that can help identify unauthorized access to the system. By using the last and lastb commands, you can easily check the login history of all users or a specific user. Keep in mind that this information is only available for a limited time and may not be available if the logs have been cleared. By following the steps outlined in this blog post, you can easily check the last successful/failed login user in Linux.