Reviewing logins on Linux
The last command provides an easy way to review recent logins on a Linux system. It also has some useful options –- such as looking for logins for one particular user or looking for logins in an older wtmp file.
The last command with no arguments will easily show you all recent logins. It pulls the information from the current wtmp (/var/log/wtmp) file and shows the logins in reverse sequential order (newest first).
$ last shs pts/1 192.168.0.15 Mon Mar 19 17:48 still logged in shs tty2 /dev/tty2 Mon Mar 19 17:37 still logged in shs pts/2 192.168.0.15 Mon Mar 19 17:22 - 17:23 (00:00) jdoe pts/3 192.168.0.15 Mon Mar 19 16:51 - 17:22 (00:31)
To look for logins for just one particular user, supply their username as an argument.