How do I extract login history?

Solution 1:

You can try the last command:

last john 

It prints out the login/out history of user john. Whereas running just

last

prints out the login/out history of all users.

Solution 2:

If you need to go further back in history than one month, you can read the /var/log/wtmp.1 file with the last command.

last -f wtmp.1 john will show the previous month's history of logins for user john.

The last log output isn't too heavy and relatively easy to parse, so I would probably pipe the output to grep to look for a specific date pattern.

last john | grep -E 'Aug (2[0-9]|30) ' to show August 20-30. Or something like:

last -f /var/log/wtmp.1 john | grep -E 'Jul (1[0-9]|2[0-9]|30) ' to acquire July 10-30 for user john.

---

Solution 3:

How to extract login history for specific date range in Linux?

An example to list all users login from 25 to 28/Aug:

last | while read line
do
    date=`date -d "$(echo $line | awk '{ print $5" "$6" "$7 }')" +%s`
    [[ $date -ge `date -d "Aug 25 00:00" +%s` && $date -le `date -d "Aug 28 00:00" +%s` ]] && echo $line
done

• awk '{ print $5" "$6" "$7 }' to extract the date time at corresponding column from last output
• +%s to convert datetime to Epoch time
• -ge stand for greater than or equal
• -le stand for less than or equal

You can also do it for specific user with last <username>.