Linux lastlog Guide - ryzendew/Linux-Tips-and-Tricks GitHub Wiki
Linux lastlog Guide
Complete beginner-friendly guide to lastlog on Linux, covering Arch Linux, CachyOS, and other distributions including last login information, user login tracking, and account activity.
Table of Contents
Understanding lastlog
What is lastlog?
lastlog shows last login time for all users.
Uses:
- Last login: When user last logged in
- Account activity: Track user activity
- Security audit: Review access patterns
- Account management: Identify unused accounts
Why it matters:
- Security: Detect suspicious activity
- Account management: Find inactive accounts
- Compliance: Track user access
lastlog Basics
View All Users
Show last logins:
# Show all users
sudo lastlog
# Shows:
# - Username
# - Port
# - Last login time
# - Host
Specific User
Check user:
# Show specific user
sudo lastlog -u username
# Show root
sudo lastlog -u root
Viewing Last Logins
Recent Logins
Limit output:
# Show users who logged in recently
sudo lastlog -t 7
# Last 7 days
Never Logged In
Inactive accounts:
# Show users who never logged in
sudo lastlog | grep "**Never logged in**"
User Information
User Range
UID range:
# Show users in UID range
sudo lastlog -u 1000-2000
# Specific range
Format Options
Different formats:
# Brief format
sudo lastlog -b
# Full format
sudo lastlog -F
Troubleshooting
lastlog Not Found
Check installation:
# Check lastlog
which lastlog
# Usually in util-linux
# Install if missing
sudo pacman -S util-linux
No Data
Check database:
# Check lastlog database
ls -la /var/log/lastlog
# May need to create
Summary
This guide covered lastlog usage, last login tracking, and user activity for Arch Linux, CachyOS, and other distributions.
Next Steps
- last Guide - Login history
- who Guide - Current users
- User and Groups - User management
- lastlog Documentation:
man lastlog
This guide covers Arch Linux, CachyOS, and other Linux distributions. For distribution-specific details, refer to your distribution's documentation.