132

Is it possible to see the login history, i mean to see if someone has used the computer in my absence and when he used it .
if it is possible, where can i get the log ?
if not, is there a program that logs all the logins and their time ?

Improve this question
2
  • 34
    try last in terminal – suhailvs Dec 13 '13 at 12:08
  • or if you want to save it in a file (say userlogin.log) use last > userlogin.log – suhailvs Dec 13 '13 at 12:15
138
/var/log/auth.log

That contains a lot more than just plain logins (sudo calls, etc) but logins are in there too. It's protected so you'll need to be root to read it:

sudo less /var/log/auth.log
Improve this answer
3
  • 2
    Exact command to print failed login history: sudo grep 'authentication failure' /var/log/auth.log | grep -v "sudo". Example output line: Feb 19 14:35:02 comp-name-1 compiz: pam_unix(unity:auth): authentication failure; logname= uid=1001 euid=1001 tty= ruser= rhost= user=ld. Command to print successful login history: sudo grep 'login keyring' /var/log/auth.log | grep -v "sudo". Example output line: Feb 18 07:17:58 comp-name-1 compiz: gkr-pam: unlocked login keyring. Probably it shows only logins after last reboot. Sudo is excluded because otherwise our own command would be also listed. – luke Feb 19 '19 at 13:40
  • sudo grep login.*session.*opened.*USERNAME /var/log/auth.log | grep -v sudo | less -N – Muhamed Huseinbašić Jan 10 '20 at 9:18
  • Even when it works, it does not report the year, only appears the user, day and time among other things – Manuel Jordan Mar 22 at 16:55
52

As Suhail mentioned in a comment, the last command will show a listing of last logged in users.

Improve this answer
25

To view the most recent login for all accounts on the system, try lastlog. There's a few useful options, such as viewing only a specific user.

Improve this answer
3
  • 3
    This tells me that no one has ever logged in (which is clearly false as I am logged in to run it) – JoshB Aug 3 '16 at 8:56
  • 1
    My lastlog output is wrong too - two of my users have entries (both wrong) and one has "never logged in". – pbhj Oct 23 '16 at 9:04
  • FYI: Looks ok on Ubuntu18 – DimiDak Mar 27 '19 at 10:01
8

Well appending your question and oli's answer if you are on laptop then you can also check it through grepping the exact content like 

sudo cat /var/log/auth.log | grep "Lid opened"

or 

sudo cat /var/log/auth.log | grep "Lid closed"

and whether he/she perform any kind of activity through sudo permission by

sudo cat /var/log/auth.log | grep "session opened for user root"

or 

sudo cat /var/log/auth.log | grep "session closed for user root"

It will give you extra information what you want to know about user's logged in your system without your permission :):)

Improve this answer
1
  • 3
    I also use sudo grep 'login keyring' /var/log/auth.org to check the login history. – Tao Wang Jul 26 '18 at 4:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.