Finding out when (and where from) a user last logged into a Linux/BSD machine

There may be times when you want to find out when and where from a user last logged into a Linux or BSD machine.

Of course, you could trawl through auth logs, but there is a quicker way by using “lastlog“.

lastlog is a command which shows you the last login time and also from where (if it was a remote session, it’ll show you the IP/Hostname) a user logged in.

If you log into the machine and at a terminal run, you’ll get the information:

droptips@server:~$ lastlog
Username         Port     From             Latest
root                                       **Never logged in**

(I’ve removed all of my information for security reasons)

droptips@server:~$  man lastlog