Checking who last logged in and when on Ubuntu Server

You might want to see a list of who logged into your Ubuntu server last or over a time period. Or maybe you want to take a look at more than just that and see more of an audit trail…

last

We can use the command last to display a “listing of last logged in users”. For example let’s just get the tail of the list using

1
last | tail

or ofcourse we might simple look through all entries using

1
last | less

What about if we know the user we’re interested in, then we can simply use

1
last -x Bob

Replacing Bob with the username you wish to look for.

There’s options to specify listing data after a specific time or before a time and more see

1
last --help

What if we want even more information.

/var/log/auth.log

Last works well if you’re interested in users logging into the server, but what about if we just want to check who’s access a shared drive or the likes, then we can check the /var/log/auth.log like this

1
2
3
4
5
sudo cat /var/log/auth.log
// or
sudo less /var/log/auth.log
// or
sudo tail /var/log/auth.log

As per standard piping of commands, I’ve included an example of using less and tail, but basically we want to list the contents of the auth.log file. Ofcourse as it’s a file we can grep it (or whatever) as required.

This auth.log file lists sessions being opened and closed, cron jobs and lots more besides.