There may be times when you want to find out when and where from a user last logged into a Linux or BSD machine.
Of course, you could trawl through auth logs, but there is a quicker way by using “lastlog“.
lastlog is a command which shows you the last login time and also from where (if it was a remote session, it’ll show you the IP/Hostname) a user logged in.
If you log into the machine and at a terminal run, you’ll get the information:
droptips@server:~$ lastlog Username Port From Latest root **Never logged in**
(I’ve removed all of my information for security reasons)
droptips@server:~$ man lastlog
The Wikipedia page is here: http://en.wikipedia.org/wiki/Lastlog