Finding out when (and where from) a user last logged into a Linux/BSD machine

There may be times when you want to find out when and where from a user last logged into a Linux or BSD machine.

Of course, you could trawl through auth logs, but there is a quicker way by using “lastlog“.

lastlog is a command which shows you the last login time and also from where (if it was a remote session, it’ll show you the IP/Hostname) a user logged in.

If you log into the machine and at a terminal run, you’ll get the information:

droptips@server:~$ lastlog
Username         Port     From             Latest
root                                       **Never logged in**

(I’ve removed all of my information for security reasons)

There is a man page available for “lastlog” accessible via:

droptips@server:~$  man lastlog

You can also read the Ubuntu 9.10 man page for lastlog here: http://manpages.ubuntu.com/manpages/karmic/man8/lastlog.8.html
The Wikipedia page is here:  http://en.wikipedia.org/wiki/Lastlog