Find the Last Logged-In Users on Linux with Lastlog Command

Linux TLDR
Last Updated:
Reading time: 3 minutes

The lastlog command in Linux shows the most recent login of all the users or a specific user by pulling the information from the β€œ/var/log/lastlog” file.

The output is a long format summary of all the user’s account names, ports, IP addresses, and last login timestamps.

Also, don’t confuse this tool with the last command, as both are separate tools and give you different information by reading different database files.

In this article, you will learn how to use the lastlog command on Linux to check the most recent login of all users or a specific user, as well as how to clear a single or all user’s last login records.

Tutorial Details

DescriptionShow the Most Recent Logins of Users
Difficulty LevelLow
Root or Sudo PrivilegesNo
OS CompatibilityUbuntu, Manjaro, Fedora, etc.
Internet RequiredNo

Usage of the Lastlog Command

The lastlog command takes one argument as an option (optional).

$ lastlog [OPTION]

The following screen will be shown when this command is executed without an option.

Output of the lastlog command

As you can see from the above picture, the lastlog command displays the record of the last login for custom as well as system created accounts that include bin, daemon, mail, etc.

Note that the β€œ**Never logged in**” message will appear for the users who have never logged in to the system, instead of their port or time.

And this will mostly happen to the system created account or service, as these accounts are set to the β€œ/sbin/nologin” shell for security purposes to restrict their direct access to the shell.

Now let’s see a few variations of this command with different options to get our desired output.

Display the Last Logged-In Record for a Specific User

Specify the user account name as an argument to the β€œ-u” flag to show the most recent login information for the referenced username.

$ lastlog -u david


Recent login timestamp for a specific user

According to the above output, β€œdavid” logged into the system last time on β€œJanuary 16” at β€œ10:50β€œ.

Display the Last Logged-In Record Before N Days

Specify the positive integer as an argument to the β€œ-b” flag that will be used to show the login record before the given number of days.

$ lastlog -b 10

The above command will show a log of all users who have logged in before the ten days.

Show log of users login before 10 days

Display the Last Logged-In Record for the Recent N Days

Identical to the previous command, the number of days assigned as an argument to the β€œ-t” flag will display the most recent user login record within the given number of days.

$ lastlog -t 10

The above command will display a log of all logged-in users in the last ten days.

Show ten days recent logs

Remove a Specific User’s Last Login Information

Specify the user account name as an argument to the β€œ-u” flag and use the β€œ-C” to remove the last login information for the referenced account.

This command should be executed with the root or sudo account.
$ sudo lastlog -u david -C


Removing a single user login entry

Clear All User’s Last Login Information

You can simply overwrite the lastlog file used to display the user’s recent login, but before that, take a copy of that file as a backup in your home directory.

$ cp /var/log/lastlog $HOME

Now you can overwrite this file by executing the following commands as the root user.

$ echo > /var/log/lastlog


Clearing all recent login records

And here comes the end of this article.

I personally prefer to use the last command instead of this to find out who logged in to the target machine, but that’s my personal preference.

Although there is nothing left to say about this tool, you can share your thoughts in the comment section.

Till then, peace!

Join The Conversation

Users are always welcome to leave comments about the articles, whether they are questions, comments, constructive criticism, old information, or notices of typos. Please keep in mind that all comments are moderated according to our comment policy.