Keeping track of your users’ activities may seem a little bit intrusive, but it is very necessary for security-conscious system administrators. When users are logged onto the system, you should know, and if a user account is up to anything suspicious, knowing when the user’s logged in might very well save your system. It may also be useful to know the last time a particular user logged on. This brief guide will explain how to do just that.
The command to view a user’s last login is simply “last”. If you just type “last” from the command line with no options, it will show you the last several logins of all users and also system reboots. Type “last” followed by the username of the user in question, and you will get only the logins from that user. For example:
This will display all information for my account on my system. The output will look like this:
tavis pts/1 :0 Mon Feb 10 22:07 still logged in
tavis pts/0 :0 Mon Feb 10 18:32 still logged in
tavis pts/0 :0 Mon Feb 10 18:23 – 18:23 (00:00)
tavis pts/0 :0 Mon Feb 10 12:56 – 18:22 (05:25)
reboot system boot 3.5.0-27-generic Mon Feb 10 12:54 – 22:07 (09:12)
The last command is useful for finding out exactly when a user was last online, which can help safeguard your system and protect the users themselves.