Find the Last Logged-In Users on Linux with Lastlog Command

The lastlog command in Linux shows the most recent login of all the users or a specific user by pulling the information from the “/var/log/lastlog” file.

The output is a long format summary of all the user’s account names, ports, IP addresses, and last login timestamps.

Also, don’t confuse this tool with the last command, as both are separate tools and give you different information by reading different database files.

In this article, you will learn how to use the lastlog command on Linux to check the most recent login of all users or a specific user, as well as how to clear a single or all user’s last login records.

Tutorial Details

Usage of the Lastlog Command

The lastlog command takes one argument as an option (optional).

$ lastlog [OPTION]

The following screen will be shown when this command is executed without an option.

As you can see from the above picture, the lastlog command displays the record of the last login for custom as well as system created accounts that include bin, daemon, mail, etc.

Note that the “**Never logged in**” message will appear for the users who have never logged in to the system, instead of their port or time.

And this will mostly happen to the system created account or service, as these accounts are set to the “/sbin/nologin” shell for security purposes to restrict their direct access to the shell.

Now let’s see a few variations of this command with different options to get our desired output.

Display the Last Logged-In Record for a Specific User

Specify the user account name as an argument to the “-u” flag to show the most recent login information for the referenced username.

$ lastlog -u david

Output:

According to the above output, “david” logged into the system last time on “January 16” at “10:50“.

Display the Last Logged-In Record Before N Days

Specify the positive integer as an argument to the “-b” flag that will be used to show the login record before the given number of days.

$ lastlog -b 10

The above command will show a log of all users who have logged in before the ten days.

Display the Last Logged-In Record for the Recent N Days

Identical to the previous command, the number of days assigned as an argument to the “-t” flag will display the most recent user login record within the given number of days.

$ lastlog -t 10

The above command will display a log of all logged-in users in the last ten days.

Remove a Specific User’s Last Login Information

Specify the user account name as an argument to the “-u” flag and use the “-C” to remove the last login information for the referenced account.

$ sudo lastlog -u david -C

Output:

Clear All User’s Last Login Information

You can simply overwrite the lastlog file used to display the user’s recent login, but before that, take a copy of that file as a backup in your home directory.

$ cp /var/log/lastlog $HOME

Now you can overwrite this file by executing the following commands as the root user.

$ echo > /var/log/lastlog

Output:

And here comes the end of this article.

I personally prefer to use the last command instead of this to find out who logged in to the target machine, but that’s my personal preference.

Although there is nothing left to say about this tool, you can share your thoughts in the comment section.

Till then, peace!