157

Is it possible to see the login history, i mean to see if someone has used the computer in my absence and when he used it .
if it is possible, where can i get the log ?
if not, is there a program that logs all the logins and their time ?

3
  • 40
    try last in terminal
    – suhailvs
    Dec 13, 2013 at 12:08
  • or if you want to save it in a file (say userlogin.log) use last > userlogin.log
    – suhailvs
    Dec 13, 2013 at 12:15
  • Following @suhailvs advice, you can add last | less if it's too much information. You can use same vim commands to search for something.
    – Pathros
    May 30, 2021 at 0:02

5 Answers 5

160
/var/log/auth.log

That contains a lot more than just plain logins (sudo calls, etc) but logins are in there too. It's protected so you'll need to be root to read it:

sudo less /var/log/auth.log
3
  • 4
    Exact command to print failed login history: sudo grep 'authentication failure' /var/log/auth.log | grep -v "sudo". Example output line: Feb 19 14:35:02 comp-name-1 compiz: pam_unix(unity:auth): authentication failure; logname= uid=1001 euid=1001 tty= ruser= rhost= user=ld. Command to print successful login history: sudo grep 'login keyring' /var/log/auth.log | grep -v "sudo". Example output line: Feb 18 07:17:58 comp-name-1 compiz: gkr-pam: unlocked login keyring. Probably it shows only logins after last reboot. Sudo is excluded because otherwise our own command would be also listed.
    – luke
    Feb 19, 2019 at 13:40
  • sudo grep login.*session.*opened.*USERNAME /var/log/auth.log | grep -v sudo | less -N Jan 10, 2020 at 9:18
  • Even when it works, it does not report the year, only appears the user, day and time among other things Mar 22, 2021 at 16:55
62

As Suhail mentioned in a comment, the last command will show a listing of last logged in users.

33

To view the most recent login for all accounts on the system, try lastlog. There's a few useful options, such as viewing only a specific user.

3
  • 3
    This tells me that no one has ever logged in (which is clearly false as I am logged in to run it)
    – JoshB
    Aug 3, 2016 at 8:56
  • 1
    My lastlog output is wrong too - two of my users have entries (both wrong) and one has "never logged in".
    – pbhj
    Oct 23, 2016 at 9:04
  • FYI: Looks ok on Ubuntu18
    – DimiDak
    Mar 27, 2019 at 10:01
8

Well appending your question and oli's answer if you are on laptop then you can also check it through grepping the exact content like

sudo cat /var/log/auth.log | grep "Lid opened"

or

sudo cat /var/log/auth.log | grep "Lid closed"

and whether he/she perform any kind of activity through sudo permission by

sudo cat /var/log/auth.log | grep "session opened for user root"

or

sudo cat /var/log/auth.log | grep "session closed for user root"

It will give you extra information what you want to know about user's logged in your system without your permission :):)

3
  • 4
    I also use sudo grep 'login keyring' /var/log/auth.org to check the login history.
    – Tao Wang
    Jul 26, 2018 at 4:25
  • Caution about "Lid closed" : This only works if the user closed the lid to suspend the laptop. If the user used the suspend-button, it obviously wouldn't log anything. Note as well that if the user suspends the computer first, and then closes the lid, then upon reopening the lid lateron, both events (lid closed + lid opened) will be logged with the same timestamp. May 17, 2021 at 13:17
  • @TaoWang : perfection :) May 17, 2021 at 13:20
0

To see the last boot or login of your system and users, you can use the command who with plenty of options.

who -a

Not the answer you're looking for? Browse other questions tagged or ask your own question.