26

I am suspecting that a Windows user logged onto my computer with my password. So, is it possible that I can see a trace of logging in on my computer?

1
  • If that person had root access to your system (through sudo for example), then you effectively can't be sure they haven't tampered with the logs.
    – Léo Lam
    Sep 17, 2015 at 17:38

2 Answers 2

28

Method 1:

Get the user login history at any time

last command will give login history for a specific username. If we don’t give any argument for this command, it will list login history for all users. By default this information will read from /var/log/wtmp file. The output of this command contains the following columns:

  • User name
  • Tty device number
  • Login date and time
  • Logout time
  • Total working time

Command: $last jason

jason   pts/0        dev-db-server   Fri Mar 27 22:57   still logged in
jason   pts/0        dev-db-server   Fri Mar 27 22:09 - 22:54  (00:45)
jason   pts/0        dev-db-server   Wed Mar 25 19:58 - 22:26  (02:28)
jason   pts/1        dev-db-server   Mon Mar 16 20:10 - 21:44  (01:33)
jason   pts/0        192.168.201.11  Fri Mar 13 08:35 - 16:46  (08:11)
jason   pts/1        192.168.201.12  Thu Mar 12 09:03 - 09:19  (00:15)
jason   pts/0        dev-db-server   Wed Mar 11 20:11 - 20:50  (00:39

Method 2:

You can also use the command lastlog command on Linux. It gives you more granular controls as to ranges of dates when looking through the logs of user logins.

lastlog man page:

lastlog - reports the most recent login of all users or of a given user

Example: To find out the users that have logged into a system in the last 100 days.

$ lastlog -b 0 -t 100
Username         Port     From             Latest
sam              pts/0    pegasus          Wed Jan  8 20:32:25 -0500     2014
joe              pts/0    192.168.1.105    Thu Dec 12 12:47:11 -0500 2013

This shows that the last times these users logged into this system. The range of time shows the last 100 days. Before today (-b 0) and after 100 days ago (-t 100).

You can also show all the users by omitting any range and just seeing every usre that's ever logged in, and the last time they logged in.

3
  • 4
    How can I delete my trace after login into his computer? :)
    – Katu
    Sep 15, 2015 at 18:01
  • Try to override a file like this using sudo access: >/var/log/wtmp. This will delete all last log info.
    – snoop
    Sep 16, 2015 at 0:31
  • The nice thing about wtmp is it's a sparse file. I can /tell/ if you delete a record from it.
    – Joshua
    Sep 16, 2015 at 2:37
8

You can use last to show you the last logins. There is also a log file for authentication specific actions in /var/log/auth.log

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .