When you are managing a secure, multi-user Linux server, you must maintain a strict audit trail of who accesses the system and when. If you suspect that a former employee or an unauthorized contractor logged into the server over the weekend, you cannot simply look at the currently active sessions. You must interrogate the server’s historical login database. To instantly print a chronological ledger of every single successful login attempt over the past month, you must use the last command.
How the last Command Works
The last command operates by reading a deeply hidden binary log file located at /var/log/wtmp. This specific file acts as the server’s master turnstile; every time a user successfully authenticates and enters the system, the kernel permanently burns a timestamp into this file. Because it is a compiled binary file, you cannot read it with standard text editors like nano or cat; you must use the last utility to decode it.
To view the master ledger, simply open your terminal and type:
lastThe terminal will instantly output a massive wall of text. The data is sorted in reverse-chronological order, meaning the most recent login (usually your current session) sits at the very top of the list.
How to Read the Login Ledger
The output is formatted into several highly specific columns:
- Username: The exact Linux account name used to authenticate (e.g.,
johnorroot). - Terminal: The physical or virtual terminal they connected to (e.g.,
pts/0for an SSH connection, ortty1for a physical keyboard plugged directly into the server). - IP Address: The exact IP address the connection originated from. If this column says
10.0.0.5, they connected from inside the office network. If it displays a foreign, external IP address, the connection originated from the public internet. - Login/Logout Times: The exact date and time the user logged in, followed by a hyphen, and the exact time they logged out.
- Duration: The total length of time they spent inside the server (e.g.,
(01:45)meaning one hour and 45 minutes). If the user is currently inside the server right now, this column will simply say still logged in.
How to Audit Specific Users or Terminals
If the server has been running for 6 months, the default last command will output thousands of lines, completely overwhelming your terminal screen. To narrow your audit, you can pass a specific username directly to the command.
If you only want to see when the user “sarah” logged in, type:
last sarahYou can also filter by the specific terminal type. If you only care about people who physically walked into the server room and plugged in a keyboard, you can filter for the primary TTY console:
last tty1This filters out all the remote SSH noise and focuses entirely on physical hardware access.