Monitor Recent Logins on Linux: last and lastlog

Updated: 2025-11-17

Monitor Recent Logins on Linux: last and lastlog

Configure automated checks to monitor recent login activity on your Linux server? Need to track user access and detect unauthorized login attempts automatic...

Why Monitoring Recent Logins Matters

Monitoring recent login activity on your Linux server is critical for security, compliance, and incident response. Unauthorized logins can indicate security breaches, compromised accounts, or insider threats. Regular login monitoring helps detect suspicious access patterns, maintain audit trails, investigate security incidents, and ensure compliance with security policies.

Method 1: Check Recent Logins with last Command

The last command displays a list of recent login sessions, showing who logged in, when, from where, and how long they stayed. This is the most common way to check login history on Linux.

Show Recent Logins

To see recent login activity:

# Show last 10 logins
last -n 10

# Show last 20 logins
last -n 20

# Show all logins (may be long)
last

Show Logins for Specific User

To check login history for a specific user:

# Show logins for specific user
last username

# Show logins for root user
last root

# Show logins for multiple users
last user1 user2

Show Currently Logged In Users

To see who is currently logged in:

# Show currently logged in users
who

# Show detailed information
who -a

# Show users with login times
w

Method 2: Check Login Logs Directly

Linux stores login information in various log files. Checking these logs provides detailed information about login attempts.

Check auth.log (Debian/Ubuntu)

# Show recent authentication attempts
sudo tail -50 /var/log/auth.log

# Show successful logins
sudo grep "Accepted" /var/log/auth.log | tail -20

# Show failed login attempts
sudo grep "Failed" /var/log/auth.log | tail -20

Check secure (CentOS/RHEL)

# Show recent authentication attempts
sudo tail -50 /var/log/secure

# Show successful logins
sudo grep "Accepted" /var/log/secure | tail -20

# Show failed login attempts
sudo grep "Failed" /var/log/secure | tail -20

Check lastlog

# Show last login for all users
lastlog

# Show last login for specific user
lastlog -u username

Method 3: Automated Login Monitoring with Zuzia.app

Manual checks work while you are looking. To keep running them without you, Zuzia uses its agent and scheduled tasks.

How it works in Zuzia

Install the Zuzia agent on the server with one command. CPU, RAM, disk, load and network metrics start reporting on their own, with alerts on a threshold, on drift from the server's normal, or on a disk fill-up forecast.
Save the commands from this guide as a scheduled task and choose how often it runs, from every minute to once a year. The agent runs it on every host you pick.
If a command fails, you get an alert right away by email, Slack, Discord, push (through your Pushover account) or SMS (through your Vonage account).
The output of every run is kept, so you can look back at what changed. On paid plans, AI can read the output and alert you only when it spots a problem.

Setting it up

Add the server in the Zuzia dashboard and install the agent.
Create a scheduled task with the check commands below, then choose the hosts and how often it runs.
Choose your notification channels. Turn on maintenance mode during planned work so it doesn't trigger alerts.

Method 4: Advanced Login Monitoring Techniques

Track Login Patterns Over Time

To identify patterns in login activity:

# Save current login list
last -n 20 > /tmp/logins-$(date +%Y%m%d-%H%M%S).txt

# Compare with previous snapshot
diff /tmp/logins-old.txt /tmp/logins-new.txt

# Find new logins
comm -13 <(sort /tmp/logins-old.txt) <(sort <(last -n 20))

Detect Login Anomalies

To identify unusual login patterns:

# Show logins from unusual hours (outside 8 AM - 6 PM)
last | awk '{print $7}' | grep -vE "08:|09:|10:|11:|12:|13:|14:|15:|16:|17:|18:"

# Show logins from unusual IP addresses
last | awk '{print $3}' | grep -E "^[0-9]" | sort | uniq

Monitor SSH Logins

For SSH-specific monitoring:

# Show SSH logins
sudo grep "sshd" /var/log/auth.log | grep "Accepted"

# Show SSH login attempts
sudo grep "sshd" /var/log/auth.log | tail -50

Real-World Use Cases for Login Monitoring

Security Audit

For security audits:

# Generate login report
last -n 50 > login-audit-$(date +%Y%m%d).txt

# Check for root logins
last root > root-logins-$(date +%Y%m%d).txt

# Check failed login attempts
sudo grep "Failed" /var/log/auth.log > failed-logins-$(date +%Y%m%d).txt

Incident Investigation

When investigating security incidents:

# Check logins during specific time period
last -s "2024-01-01 00:00:00" -t "2024-01-01 23:59:59"

# Check logins from specific IP
last | grep "192.168.1.100"

# Check logins for specific user
last username | head -20

Compliance Monitoring

For compliance requirements:

# Generate compliance report
last -n 100 > compliance-report-$(date +%Y%m%d).txt

# Check for unauthorized access
last | grep -vE "authorized-user1|authorized-user2"

Best Practices for Login Monitoring

1. Monitor Logins Regularly

Check login history every hour or every few hours. This allows you to detect unauthorized access quickly while not generating excessive alerts. Use Zuzia.app automated monitoring to check logins continuously without manual intervention.

2. Monitor Failed Login Attempts

Failed login attempts can indicate brute force attacks. Monitor failed logins and alert when thresholds are exceeded.

3. Track Root Logins

Root logins should be monitored closely. Alert on all root logins and verify they are authorized.

4. Monitor Unusual Patterns

Set up alerts for logins from unusual IP addresses, unusual times, or unusual locations.

5. Maintain Audit Trails

Keep login logs for compliance and investigation purposes. Use Zuzia.app to store login history in its database.

Troubleshooting Common Login Monitoring Issues

Login History Not Showing

If login history isn't showing:

# Check if utmp/wtmp files exist
ls -la /var/log/wtmp /var/run/utmp

# Check lastlog
lastlog

# Check auth logs
sudo tail -50 /var/log/auth.log

Too Many Login Entries

If there are too many login entries:

# Limit output
last -n 20

# Filter by user
last username

# Filter by time
last -s "2024-01-01"

FAQ: Common Questions About Monitoring Recent Logins

How often should I check login history?

We recommend checking login history every hour or every few hours. This allows you to detect unauthorized access quickly while not generating excessive alerts. Use Zuzia.app automated monitoring to check logins continuously without manual intervention.

What if unexpected logins are detected?

You'll receive notifications when login activity is detected through Zuzia.app. You can then investigate whether logins are authorized or indicate a security concern. Check the login details, verify with users, and take appropriate security actions if unauthorized access is confirmed.

Can I see login IP addresses?

Yes, the last command shows IP addresses for remote logins, which can help identify the source of access attempts. Use last | awk '{print $3}' to extract IP addresses and analyze login sources.

How do I detect unauthorized logins?

Set up automated monitoring in Zuzia.app that compares current logins with expected patterns. Alert on logins from unusual IP addresses, unusual times, or for users who shouldn't have access. Monitor failed login attempts as they can indicate brute force attacks.

Can I track login patterns over time?

Yes, use Zuzia.app to store login history in its database. This allows you to track login patterns over time, identify trends, and detect anomalies. Compare current logins with historical patterns to identify unusual activity.

How can I monitor logins across multiple servers?

Zuzia.app allows you to add multiple servers and monitor login activity across all of them simultaneously. Each server executes commands independently, and all results are stored in Zuzia.app's database for centralized monitoring and analysis.

Does Zuzia.app use AI to analyze login patterns?

On paid plans, AI can read the output of your scheduled tasks and commands, explain it in plain language and alert you only when it spots a problem. Metric alerts work without AI: Zuzia alerts when CPU, RAM or load drifts from the server's normal and forecasts when a disk will fill up.

Monitor Recent Logins on Linux: last and lastlog