Linux provides some commands to view the user: login status, login record, login attempt log, user last login log and so on.

Show the Logged in Users and Their Activities

With the w command, we can see who is currently logged in and what they are doing.

Here are some common options for w command:

1

w

Show Without the Header

With the -h option, we can view only the content without displaying the title:

1

w -h    # This equivalent to w --no-header

Show the Short Format

With the -s option, we can view only the output in a short format:

1

w -s    # This equivalent to w --short

Show Without the From Column

With the -f option, we can view only the output other than the from column:

1

w -f    # This equivalent to w --from

Show the IP Address Instead of Hostname

With the -i option, we can view the ip address instead of the hostname:

1

w -i    # This equivalent to w --ip-addr

Show Users Login Records

With the last command, we can see users’ login records.

Here are some common options for last command:

1

last

Number of Rows to Show

With the -n or ‑‑lines option, we can specify the number of rows to output for the log-in records:

1

last -n 10    # This is equivalent to last -10 or last --lines 10

Show Log in Failed Record

The options for the lastb command are similar to those for the last command.

1

lastb

Displays Ten Lines of Login Failure Records

With the -n or ‑‑lines option, we can specify the number of rows to output for the log-in failed records:

1

lastb -n 10    # this is equivalent to lastb -10 or lastb --lines 10

We can see from the screenshot that someone is trying to log on to my server.

Show the Last Login Record of Users

We can use the lastlog command to display the record of all or a user’s last login:

1

lastlog

Show the Record of a Specific User

With the -u option, we can view only the last login record of a specified user:

1

lastlog -u root

References 20 User information, W(1), LAST, LASTB(1), LASTLOG(8)

Buy me a coffee