You might want to see a list of who logged into your Ubuntu server last or over a time period. Or maybe you want to take a look at more than just that and see more of an audit trail…<\/p>\n
last<\/strong><\/p>\n We can use the command last<\/em> to display a “listing of last logged in users”. For example let’s just get the tail of the list using<\/p>\n or ofcourse we might simple look through all entries using<\/p>\n What about if we know the user we’re interested in, then we can simply use<\/p>\n Replacing Bob<\/em> with the username you wish to look for.<\/p>\n There’s options to specify listing data after a specific time or before a time and more see<\/p>\n What if we want even more information.<\/p>\n \/var\/log\/auth.log<\/strong><\/p>\n Last<\/em> works well if you’re interested in users logging into the server, but what about if we just want to check who’s access a shared drive or the likes, then we can check the \/var\/log\/auth.log like this<\/p>\n As per standard piping of commands, I’ve included an example of using less and tail, but basically we want to list the contents of the auth.log file. Ofcourse as it’s a file we can grep it (or whatever) as required.<\/p>\n This auth.log file lists sessions being opened and closed, cron jobs and lots more besides. <\/p>\n","protected":false},"excerpt":{"rendered":" You might want to see a list of who logged into your Ubuntu server last or over a time period. Or maybe you want to take a look at more than just that and see more of an audit trail… last We can use the command last to display a “listing of last logged in […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[140],"tags":[],"class_list":["post-8938","post","type-post","status-publish","format-standard","hentry","category-ubuntu"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/posts\/8938","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/comments?post=8938"}],"version-history":[{"count":5,"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/posts\/8938\/revisions"}],"predecessor-version":[{"id":8950,"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/posts\/8938\/revisions\/8950"}],"wp:attachment":[{"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/media?parent=8938"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/categories?post=8938"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/putridparrot.com\/blog\/wp-json\/wp\/v2\/tags?post=8938"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\r\nlast | tail\r\n<\/pre>\n
\r\nlast | less\r\n<\/pre>\n
\r\nlast -x Bob\r\n<\/pre>\n
\r\nlast --help\r\n<\/pre>\n
\r\nsudo cat \/var\/log\/auth.log\r\n\/\/ or \r\nsudo less \/var\/log\/auth.log\r\n\/\/ or\r\nsudo tail \/var\/log\/auth.log\r\n<\/pre>\n