94

I need to know the login history for specific user (i.e. login and logout time), How do I extract this history for a specific date range in Linux ?

133

You can try the last command:

last john 

It prints out the login/out history of user john. Whereas running just

last

prints out the login/out history of all users.

  • 5
    This only returns values for the current month in most Linux distros. – ewwhite Aug 28 '11 at 22:55
42

If you need to go further back in history than one month, you can read the /var/log/wtmp.1 file with the last command.

last -f wtmp.1 john will show the previous month's history of logins for user john.

The last log output isn't too heavy and relatively easy to parse, so I would probably pipe the output to grep to look for a specific date pattern.

last john | grep -E 'Aug (2[0-9]|30) ' to show August 20-30. Or something like:

last -f /var/log/wtmp.1 john | grep -E 'Jul (1[0-9]|2[0-9]|30) ' to acquire July 10-30 for user john.

21

How to extract login history for specific date range in Linux?

An example to list all users login from 25 to 28/Aug:

last | while read line
do
    date=`date -d "$(echo $line | awk '{ print $5" "$6" "$7 }')" +%s`
    [[ $date -ge `date -d "Aug 25 00:00" +%s` && $date -le `date -d "Aug 28 00:00" +%s` ]] && echo $line
done
  • awk '{ print $5" "$6" "$7 }' to extract the date time at corresponding column from last output
  • +%s to convert datetime to Epoch time
  • -ge stand for greater than or equal
  • -le stand for less than or equal

You can also do it for specific user with last <username>.

  • 1
    That's a mighty-ugly expression. Wouldn't grep be cleaner since last output is pretty readable? – ewwhite Aug 28 '11 at 13:33
  • 3
    Can you grep from "Aug 15 09:00" to "Aug 25 21:00"? – quanta Aug 28 '11 at 13:45
  • 1
    The OP didn't ask for time ranges. – ewwhite Aug 28 '11 at 21:18
  • 1
    @ewwhite the expression looks beautiful to me, if you dont like the look of bash syntax this may not be the site for you. – ekerner Oct 18 '17 at 6:53
  • 1
    @ekerner You're right. I'll go somewhere else ;) – ewwhite Oct 18 '17 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.