Login History

Whether you're investigating suspicious activity or you're just curious about past logins, it's good to know where to look to find your login history. There are three separate files that contain user login information for your server:

/var/log/wtmp - contains logs of login and logout attempts

/var/run/utmp - contains logs of current logins

/var/log/btmp - contains logs of bad login attempts

This article from Linux Handbook has more in depth descriptions of these:

How to Check Linux Login History

As mentioned in this other Community post, you can access any of these logs using your favorite text editor (nano, vi, etc.), but since they allow you to edit the file, it's generally a better idea to use the cat and less (or last) commands to display the logs as output and navigate page by page.

An example of how to do this might be:

cat /var/log/utmp | less

How to navigate with less: Unix Less Command: 10 Tips for Effective Navigation

Or if you're using last: Linux last Command Tutorial

*Something to keep in mind is that you will need to be logged in as a user with the proper permissions to read and access log files.

Hope this helps - happy log reading!

For ssh(1)/scp(1)/sftp(1) logins, you need to consult /var/log/auth.log.

-- sw