Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to know the login history for specific user (i.e. login and logout time), How do I extract this history for a specific date range in Linux ?

share|improve this question
up vote 49 down vote accepted

You can try the last command

last john 

prints out the login/out history of user john, whereas running just


prints out the login/out history of all users

share|improve this answer
This only returns values for the current month in most Linux distros. – ewwhite Aug 28 '11 at 22:55

If you need to go further back in history than one month, you can read the /var/log/wtmp.1 file with the last command.

last -f wtmp.1 john will show the previous month's history of logins for user john.

The last log output isn't too heavy and relatively easy to parse, so I would probably pipe the output to grep to look for a specific date pattern.

last john | grep -E 'Aug (2[0-9]|30) ' to show August 20-30. Or something like:

last -f /var/log/wtmp.1 john | grep -E 'Jul (1[0-9]|2[0-9]|30) ' to acquire July 10-30 for user john.

share|improve this answer

How to extract login history for specific date range in Linux?

An example to list all users login from 25 to 28/Aug:

last | while read line
    date=`date -d "$(echo $line | awk '{ print $5" "$6" "$7 }')" +%s`
    [[ $date -ge `date -d "Aug 25 00:00" +%s` && $date -le `date -d "Aug 28 00:00" +%s` ]] && echo $line
  • awk '{ print $5" "$6" "$7 }' to extract the date time at corresponding column from last output
  • +%s to convert datetime to Epoch time
  • -ge stand for greater than or equal
  • -le stand for less than or equal

You can also do it for specific user with last <username>.

share|improve this answer
That's a mighty-ugly expression. Wouldn't grep be cleaner since last output is pretty readable? – ewwhite Aug 28 '11 at 13:33
Can you grep from "Aug 15 09:00" to "Aug 25 21:00"? – quanta Aug 28 '11 at 13:45
The OP didn't ask for time ranges. – ewwhite Aug 28 '11 at 21:18
Could you filter from "Jul 19" to "Aug 11" by grep? – quanta Aug 29 '11 at 0:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.