How to view historical login user records in Linux?

Linux system is an open source operating system. Users can view the historical login user records of the system through some simple commands. This is one of the very important maintenance tasks for system administrators. The following will introduce several methods on how to view historical login user records in Linux systems.

1. Use the last command

The last command can display the history of recently logged in users. Enter the following command in the terminal:

last

The system will display the history of recently logged in users, including user name, login time, IP address and other information. You can use last -n to limit the number of records displayed. For example, last -n 5 will only display the five most recent records.

2. Use the lastb command

The lastb command is used to display failed login attempt records. You can also limit the number of displayed entries by running lastb -n 5.

lastb

3. Use the /var/log/wtmp file

The system will record the user’s login information in the /var/log/wtmp file. For some earlier login records, you can Get information directly by viewing this file.

who /var/log/wtmp

4. Use the journalctl command

When the system uses the systemd logging system, you can use the journalctl command to view the system's activity logs, including user login records.

journalctl _COMM=login

5. Use the utmpdump command

The utmpdump command is used to display the information saved in the /var/run/utmp file in human-readable form.

utmpdump /var/run/utmp

Through the above methods, you can easily view the historical login user records in the Linux system, helping administrators to monitor the security of the system in a timely manner and discover abnormal login behaviors in a timely manner.

The above is the detailed content of How to view historical login user records in Linux?. For more information, please follow other related articles on the PHP Chinese website!