Is there a log available where we can see login attempts, both failed and successful, for all users in 18.04 ? Also, any possible info about last logged in for a user ? Thanks.


Not a single log, but successful logins are logged in /var/log/wtmp and unsuccessful ones in /var/log/btmp. These are binary files, but are readable via the last and lastb commands. From man last:

       last  searches  back through the /var/log/wtmp file (or the file desig‐
       nated by the -f option) and displays a list of all users logged in (and
       out)  since  that  file was created.


       lastb is the same as last, except that by default it shows a log of the
       /var/log/btmp file, which contains all the bad login attempts.

Note that access to the btmp (failed login) file is restricted for security reasons: while neither file records password strings by design, a not uncommon cause of failed logins is when users mistakenly type their password into the login field. Hence sudo is needed when running lastb.

Also note that the files are rotated - you may wish to look back through earlier logs ex.

sudo lastb -f /var/log/btmp.1
| improve this answer | |
  • I tried lastb, it says permission denied. Tried sudo , but that too didn't throw a list. When tried with sudo, it simply gives the creation date of btmp file. – user227495 Jul 27 '19 at 3:05
  • sudo last works and no log with lastb? Maybe there is no login failure... – cmak.fr Jul 27 '19 at 4:16
  • I asked this question because I mistyped the password a few times. I was curious about how I will track such failed attempts. last works without sudo. It is lastb which do not give a list, sudo or not. – user227495 Jul 27 '19 at 5:08
  • @user227495 please see update - if plain sudo lastb doesn't show the expected attempt, try looking back through previous logs (/var/log/btmp.1 and so on) – steeldriver Jul 27 '19 at 12:26
  • Thanks @steeldriver . But there is only one btmp. Nothing in log folder with btmp varients. – user227495 Jul 27 '19 at 15:51

There is a package called "audit". You can install it with:

sudo apt install auditd

Then you will need to start and enable it to start at boot:

sudo systemctl start audit
sudo systemctl enable audit

All login attempt whether successful or not will log to /var/log/auth.log (ssh logins are already logged there as well). Also the package has a reporting ability:

Successful attempts summary:

aureport -l --success --summary -i | less

Failed attempts report:

aureport -au -i --failed | less

You can swap "--failed" with "--success" or vice-versa in the above commands.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.