Is it possible to see the login history, i mean to see if someone has used the computer in my absence and when he used it .
if it is possible, where can i get the log ?
if not, is there a program that logs all the logins and their time ?
/var/log/auth.log
That contains a lot more than just plain logins (sudo calls, etc) but logins are in there too. It's protected so you'll need to be root to read it:
sudo less /var/log/auth.log
-
2Exact command to print failed login history:
sudo grep 'authentication failure' /var/log/auth.log | grep -v "sudo"
. Example output line:Feb 19 14:35:02 comp-name-1 compiz: pam_unix(unity:auth): authentication failure; logname= uid=1001 euid=1001 tty= ruser= rhost= user=ld
. Command to print successful login history:sudo grep 'login keyring' /var/log/auth.log | grep -v "sudo"
. Example output line:Feb 18 07:17:58 comp-name-1 compiz: gkr-pam: unlocked login keyring
. Probably it shows only logins after last reboot. Sudo is excluded because otherwise our own command would be also listed. – luke Feb 19 '19 at 13:40 -
sudo grep login.*session.*opened.*USERNAME /var/log/auth.log | grep -v sudo | less -N
– Muhamed Huseinbašić Jan 10 '20 at 9:18 -
Even when it works, it does not report the year, only appears the user, day and time among other things – Manuel Jordan Mar 22 at 16:55
To view the most recent login for all accounts on the system, try lastlog
. There's a few useful options, such as viewing only a specific user.
Well appending your question and oli's answer if you are on laptop then you can also check it through grepping the exact content like
sudo cat /var/log/auth.log | grep "Lid opened"
or
sudo cat /var/log/auth.log | grep "Lid closed"
and whether he/she perform any kind of activity through sudo permission by
sudo cat /var/log/auth.log | grep "session opened for user root"
or
sudo cat /var/log/auth.log | grep "session closed for user root"
It will give you extra information what you want to know about user's logged in your system without your permission :):)
-
3I also use
sudo grep 'login keyring' /var/log/auth.org
to check the login history. – Tao Wang Jul 26 '18 at 4:25
last
in terminal – suhailvs Dec 13 '13 at 12:08last > userlogin.log
– suhailvs Dec 13 '13 at 12:15