Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to know the login history for specific user (i.e. login and logout time), How do I extract this history for a specific date range in Linux ?

share|improve this question

3 Answers 3

up vote 19 down vote accepted

You can try the last command

last john 

prints out the login/out history of user john, whereas running just

last

prints out the login/out history of all users

share|improve this answer
1  
This only returns values for the current month in most Linux distros. –  ewwhite Aug 28 '11 at 22:55

If you need to go further back in history than one month, you can read the /var/log/wtmp.1 file with the last command.

last -f wtmp.1 john will show the previous month's history of logins for user john.

The last log output isn't too heavy and relatively easy to parse, so I would probably pipe the output to grep to look for a specific date pattern.

last john | grep -E 'Aug (2[0-9]|30) ' to show August 20-30. Or something like:

last -f /var/log/wtmp.1 john | grep -E 'Jul (1[0-9]|2[0-9]|30) ' to acquire July 10-30 for user john.

share|improve this answer

How to extract login history for specific date range in Linux?

An example to list all users login from 25 to 28/Aug:

last | while read line; do date=`date -d "$(echo $line | awk '{ print $5" "$6" "$7 }')" +%s`; [[ $date -ge `date -d "Aug 25 00:00" +%s` && $date -le `date -d "Aug 28 00:00" +%s` ]] && echo $line; done
  • awk '{ print $5" "$6" "$7 }' to extract the date time at corresponding column from last output
  • +%s to convert datetime to Epoch time
  • -ge stand for greater than or equal
  • -le stand for less than or equal

You can also do it for specific user with last <username>.

share|improve this answer
    
That's a mighty-ugly expression. Wouldn't grep be cleaner since last output is pretty readable? –  ewwhite Aug 28 '11 at 13:33
1  
Can you grep from "Aug 15 09:00" to "Aug 25 21:00"? –  quanta Aug 28 '11 at 13:45
    
The OP didn't ask for time ranges. –  ewwhite Aug 28 '11 at 21:18
    
Could you filter from "Jul 19" to "Aug 11" by grep? –  quanta Aug 29 '11 at 0:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.