Where does openssh-server get the "Last Login" information from?

I recently logged in remotely from a Windows machine using SSH Secure Shell 3.2.9 and the reported last login was from a network location I do not recognize. I then checked auth.log (more specifically, auth.log.1) and found no log entries pertaining to the reported network location. I usually remote in via VPN so I know the IP of the computer logged-in changes. However, it typically takes the form of an IP address where as this particular attempt was recorded as unknownComputerName.knownNetworkName. I find it a bit odd that there is no matching entry in auth.log because I know for a fact that even failed attempts are recorded.

Also, I am new to using Ubuntu and a novice at remote access. That being said, please correct any mistakes I may have made with regards to terminology. Also, please let me know if this type of question is better asked somewhere else.

  • 2
    Try the last command. The "Last login" message you get when logging in via SSH should be the same as the second most recent line in the output from the last command. (The most recent being the SSH session itself). last uses the /var/log/wtmp file. Jun 11, 2016 at 16:39
  • Doug Smythies, I am not sure whether it is you or Jakuje whom is correct, but your answer gave me what I was looking for. The open and close times of the session in question do appear to line-up closely with an sshd session recorded in auth.log. However, in the auth.log file, an IP address is given. Is it possible that Ubuntu used the name in one file and the IP address in another? Jun 11, 2016 at 21:24
  • I think, but am not sure, that last does the IP to name lookup during execution. I currently have remote SSH access disabled, but I can force lookups of my LAN SSH sessions with last --dns. I also dumped /var/log/wtmp and I only observe raw IP addresses in that file. Jun 11, 2016 at 23:32

1 Answer 1


There is database in /var/log/lastlog (binary AFAIK). See the manual page for lastlog(8). The file should be updated by the PAM module pam_lastlog(8).

There might be some difference in what Ubuntu version you are using (I don't have this file, nor the message in my 15.10).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .