When you are managing a highly secure Linux web server, tracking user access is a critical forensic requirement. If a rogue employee or a compromised SSH key is accessing the server in the middle of the night, you cannot rely on active monitoring tools like w or who, because those only show you who is logged in right now. To mathematically force the Linux kernel to audit its historical security logs and dump a structured report of every user’s most recent connection, you must use the lastlog command.
Extracting the Forensic History
The lastlog command is a specialized security parsing engine. It does not look at active processes. Instead, it directly reads the raw cryptographic data stored inside the /var/log/lastlog binary file, decodes it, and translates it into a human-readable table.
To execute a global historical audit, simply type:
lastlogThe exact millisecond you press Enter, the engine rips through the binary file and outputs a highly structured table directly to your terminal. This table lists every single user account mathematically coded into your system, the exact terminal (or IP address) they connected from, and the absolute precise timestamp of their very last successful login.
CRITICAL WARNING: You will see many system accounts (like bin or daemon) listed as **Never logged in**. This is mathematically correct. These are internal architectural accounts designed to run software, not for human SSH access.
Constraining the Audit to Specific Users
If you have 500 users on a corporate server, dumping the entire table is visually chaotic. If you are forensically investigating a single suspicious user account (e.g., the user john_doe), you can mathematically constrain the engine using the -u (user) flag.
lastlog -u john_doeThe engine instantly bypasses the massive table and outputs a single, pristine line detailing the exact timestamp and IP address of John Doe’s last connection. If John claims he hasn’t logged in for a week, but the engine outputs a timestamp from 2:00 AM this morning, you have absolute mathematical proof of a security breach.
Constraining the Audit Chronologically
If you suspect a server breach happened over the weekend, you can force the lastlog engine to only output records of users who have successfully authenticated within a specific timeframe using the -t (time/days) flag.
lastlog -t 3The engine will execute the global scan, violently filter out any login timestamp older than exactly 3 days (72 hours), and output a highly concentrated, actionable forensic report of only the most recent security events.