Is it possible to see the login history, i mean to see if someone has used the computer in my absence and when he used it .
if it is possible, where can i get the log ?
if not, is there a program that logs all the logins and their time ?
5 Answers
/var/log/auth.log
That contains a lot more than just plain logins (sudo calls, etc) but logins are in there too. It's protected so you'll need to be root to read it:
sudo less /var/log/auth.log
-
4Exact command to print failed login history:
sudo grep 'authentication failure' /var/log/auth.log | grep -v "sudo". Example output line:Feb 19 14:35:02 comp-name-1 compiz: pam_unix(unity:auth): authentication failure; logname= uid=1001 euid=1001 tty= ruser= rhost= user=ld. Command to print successful login history:sudo grep 'login keyring' /var/log/auth.log | grep -v "sudo". Example output line:Feb 18 07:17:58 comp-name-1 compiz: gkr-pam: unlocked login keyring. Probably it shows only logins after last reboot. Sudo is excluded because otherwise our own command would be also listed.– lukeFeb 19, 2019 at 13:40 -
sudo grep login.*session.*opened.*USERNAME /var/log/auth.log | grep -v sudo | less -NJan 10, 2020 at 9:18 -
Even when it works, it does not report the year, only appears the user, day and time among other things Mar 22, 2021 at 16:55
To view the most recent login for all accounts on the system, try lastlog. There's a few useful options, such as viewing only a specific user.
answered Sep 20, 2015 at 1:33
Well appending your question and oli's answer if you are on laptop then you can also check it through grepping the exact content like
sudo cat /var/log/auth.log | grep "Lid opened"
or
sudo cat /var/log/auth.log | grep "Lid closed"
and whether he/she perform any kind of activity through sudo permission by
sudo cat /var/log/auth.log | grep "session opened for user root"
or
sudo cat /var/log/auth.log | grep "session closed for user root"
It will give you extra information what you want to know about user's logged in your system without your permission :):)
-
4I also use
sudo grep 'login keyring' /var/log/auth.orgto check the login history.– Tao WangJul 26, 2018 at 4:25 -
Caution about "Lid closed" : This only works if the user closed the lid to suspend the laptop. If the user used the suspend-button, it obviously wouldn't log anything. Note as well that if the user suspends the computer first, and then closes the lid, then upon reopening the lid lateron, both events (lid closed + lid opened) will be logged with the same timestamp. May 17, 2021 at 13:17
-
To see the last boot or login of your system and users, you can use the command who with plenty of options.
who -a
lastin terminallast > userlogin.loglast | lessif it's too much information. You can use samevimcommands to search for something.