182

Is it possible to see the login history, i mean to see if someone has used the computer in my absence and when he used it .
if it is possible, where can i get the log ?
if not, is there a program that logs all the logins and their time ?

Dzero
  • 3,178

5 Answers5

186
/var/log/auth.log

That contains a lot more than just plain logins (sudo calls, etc) but logins are in there too. It's protected so you'll need to be root to read it:

sudo less /var/log/auth.log
Oli
  • 293,335
  • 5
    Exact command to print failed login history: sudo grep 'authentication failure' /var/log/auth.log | grep -v "sudo". Example output line: Feb 19 14:35:02 comp-name-1 compiz: pam_unix(unity:auth): authentication failure; logname= uid=1001 euid=1001 tty= ruser= rhost= user=ld. Command to print successful login history: sudo grep 'login keyring' /var/log/auth.log | grep -v "sudo". Example output line: Feb 18 07:17:58 comp-name-1 compiz: gkr-pam: unlocked login keyring. Probably it shows only logins after last reboot. Sudo is excluded because otherwise our own command would be also listed. – luke Feb 19 '19 at 13:40
  • 1
    sudo grep login.*session.*opened.*USERNAME /var/log/auth.log | grep -v sudo | less -N – Muhamed Huseinbašić Jan 10 '20 at 09:18
  • Even when it works, it does not report the year, only appears the user, day and time among other things – Manuel Jordan Mar 22 '21 at 16:55
76

As Suhail mentioned in a comment, the last command will show a listing of last logged in users.

Community
  • 1
Don Kirkby
  • 1,457
34

To view the most recent login for all accounts on the system, try lastlog. There's a few useful options, such as viewing only a specific user.

TheKarateKid
  • 471
8

Well appending your question and oli's answer if you are on laptop then you can also check it through grepping the exact content like 

sudo cat /var/log/auth.log | grep "Lid opened"

or 

sudo cat /var/log/auth.log | grep "Lid closed"

and whether he/she perform any kind of activity through sudo permission by

sudo cat /var/log/auth.log | grep "session opened for user root"

or 

sudo cat /var/log/auth.log | grep "session closed for user root"

It will give you extra information what you want to know about user's logged in your system without your permission :):)

Deepanshu Jain
  • 946
  • 5
    I also use sudo grep 'login keyring' /var/log/auth.org to check the login history. – Tao Wang Jul 26 '18 at 04:25
  • Caution about "Lid closed" : This only works if the user closed the lid to suspend the laptop. If the user used the suspend-button, it obviously wouldn't log anything. Note as well that if the user suspends the computer first, and then closes the lid, then upon reopening the lid lateron, both events (lid closed + lid opened) will be logged with the same timestamp. – Johannes Lemonde May 17 '21 at 13:17
  • @TaoWang : perfection :) – Johannes Lemonde May 17 '21 at 13:20
0

To see the last boot or login of your system and users, you can use the command who with plenty of options.

who -a
Markus Zeller
  • 131