3 Easy Methods to Check Linux Login History

Written by

Ojash

Reviewed by

Akshat

Last updated: July 12, 2024

Expert verified

Keeping track of who logs into your Linux system is crucial for security and troubleshooting. There’s an easy way to find out. In this post, I’ll show you how to check Linux login history. You’ll learn what login history is, why it’s important to monitor it, and the best methods to track login activities. From using simple commands like last to examining log files, I’ll cover everything you need to know to keep your system secure.

What is Linux Login History?

Linux login history is a record of all user login activities on a Linux system. It includes information about who logged in, when they logged in, and from where (such as which computer or IP address). This history helps you track user access and activity over time.

Monitoring login history is crucial for several reasons:

• Regularly checking your login history helps you spot any unauthorized login attempts, allowing you to take action quickly to secure your system.
• By monitoring your login history, you can identify suspicious activities and potential security breaches that might compromise your system.
• Tracking login history ensures that users adhere to company policies and access controls, maintaining the integrity of your system.
• Login history provides valuable information for troubleshooting user-related issues and understanding their actions on the system.
• Monitoring login history helps you verify what users are doing on the system, ensuring accountability and transparency.
• Regularly reviewing login history is a key practice in maintaining overall system security and preventing unauthorized access.

How to Check Login History Linux?

Here are the detailed steps for three different methods to check Linux Login History:

1. Examining the Auth Log

The auth log is a valuable source of login-related information in Linux systems. By examining the auth log, you can access a comprehensive list of login events, including timestamps, usernames, IP addresses, and authentication methods. To access and analyze the auth log, follow these steps:

1. Open the Terminal window. 

2. Enter the following command to view the auth log: 

sudo tail -f /var/log/auth.log

The auth log will display the Linux last login history, including timestamps, usernames, IP addresses, and authentication methods.

2. Utilizing the Last Command

The last command offers a straightforward way to retrieve Linux login history. Using the last command, you can view the login records for all users or retrieve the login history for a specific user. Follow these steps to use the last command to Linux show login history:

1. Open the Terminal and type last to display the Linux login logs for all users.

2. To retrieve the Linux login log for a specific user, use the command 

last username

The output will be:

4. To see the Last 10 Logins, type the following command and press Enter:

last -n 10

This command displays the last 10 logins on the system.

3. Parsing the Wtmp File

The wtmp file stores login records in Linux systems and can be parsed to access login history. Parsing the wtmp file lets you delve into historical login records and gain insights into user logins, session durations, and other relevant details. Here’s how you can parse the wtmp file to check login history Linux:

1. Locate the wtmp file on your system. Usually, it is located in /var/log/wtmp.

utmpdump /var/log/wtmp

2. Various tools and techniques can help you parse the wtmp file and extract login-related information. Some commonly used tools include last, utmpdump, and fwtmp. In this case, I used the utmpdump tool.

Advanced Methods to Check Login History in Linux

1. Tracking Failed Login Attempts

Tracking failed login attempts helps you detect potential security issues by identifying unsuccessful login tries. This is crucial for spotting unauthorized access attempts and strengthening system security.

1. Open the Terminal.

sudo lastb

2. Enter your password if prompted to execute the command with superuser privileges.

The output will show details of failed attempts, such as the username, IP address, and time of the attempt.

2. Analyzing Login Data by Time Periods

Analyzing login data by time periods helps you identify trends and patterns in system access. This can reveal peak login times and detect unusual activity during off-hours.

1. In your Terminal window use the last Command with the Date Range:

last -s YYYY-MM-DD -t YYYY-MM-DD

Replace YYYY-MM-DD with your desired start and end dates. The output will show login details within the specified date range.

2. To narrow it down to a specific user, use:

last -s YYYY-MM-DD -t YYYY-MM-DD username

It will show the login logs of specific user of the specified time period.

3. Filtering Login Records by Terminal

Filtering login records by terminal allows you to focus on specific sessions or locations. This is useful for investigating access points and monitoring remote logins.

1. Access your command window.
2. Use the last Command with Terminal:

last | grep tty2

Replace tty2 with the desired Terminal.

3 Best Practices to Check Linux User Login History

Checking login history is essential for detecting unauthorized access attempts, identifying security breaches, and ensuring compliance. By following these best practices, you can enhance the security of your Linux system and effectively monitor login history. Here are three best practices for effectively checking login history in Linux systems.

• 🛡️ Regularly Review and Analyze Login Records: To effectively monitor login history, reviewing and analyzing login records is important. By routinely examining the auth log, last command outputs, or parsed wtmp files, you can identify any suspicious login attempts, unusual patterns, or unauthorized access.
• 🔒 Implement Secure Authentication Measures: Implementing secure authentication measures is crucial for preventing unauthorized access to your Linux system. Use strong passwords, enforce multi-factor authentication (MFA), and regularly update user credentials.
• 📅 Maintain Sufficient Log Retention Periods: Maintaining an adequate log retention period is vital for preserving historical login records. Configure your system to retain log files, such as the auth log and wtmp file, for a sufficient duration based on your organization’s requirements and compliance standards.

Linux Check Login History: Final Thoughts

I hope this article has provided valuable insights into the methods of checking log history in Linux systems, the benefits it offers, and the importance of following best practices.

To enhance your Linux knowledge, explore these articles below:

Frequently Asked Questions