Knowing who logged in, when, and from where is basic server hygiene, and the first thing to check if you suspect a break-in. Linux records successful logins, failed attempts, and reboots in a few places. Here’s how to read them.

last: recent successful logins

last                    # most recent first
last -n 20              # last 20 entries
last -a                 # show hostname/IP in the last column
last alice              # one user
last -s yesterday       # since a time (util-linux)
last reboot             # reboot history

Example:

alice    pts/0   203.0.113.50   Wed Nov  5 09:14   still logged in
root     pts/1   198.51.100.7   Tue Nov  4 22:03 - 22:41  (00:38)
reboot   system boot  6.8.0-88-generic Tue Nov  4 21:58   still running

last reads /var/log/wtmp. On some newer distributions, wtmp is replaced by wtmpdb (wtmpdb last), or the information is only in the journal.

lastb: failed login attempts

sudo lastb | head -20
sudo lastb | awk '{print $3}' | sort | uniq -c | sort -rn | head      # top source IPs

Reads /var/log/btmp. On an internet-facing server, you’ll see constant attempts from bots. That’s normal noise, and why you use SSH keys and Fail2ban. See Fail2ban.

lastlog: last login per user

lastlog
lastlog -u alice
lastlog -b 90           # users who haven't logged in for 90+ days

Accounts that should never log in (service users) should show “Never logged in”. If one shows a recent login, investigate. (On newer distributions, lastlog2 replaces lastlog.)

SSH logs: the most detail

# Debian/Ubuntu
sudo grep -E 'Accepted|Failed' /var/log/auth.log | tail -20
# RHEL family
sudo grep -E 'Accepted|Failed' /var/log/secure | tail -20
# any systemd system
journalctl -u ssh --since "24 hours ago" | grep -E 'Accepted|Failed'   # unit is "sshd" on RHEL

Accepted publickey for alice from 203.0.113.50 port 51234 ssh2: ED25519 SHA256:… shows the user, the source IP, and which key was used. Compare the fingerprint with your known keys (ssh-keygen -lf ~/.ssh/authorized_keys).

See journalctl and SSH keys.

Who’s logged in right now?

who
w

See who and w commands.

Spotting suspicious access

Red flags:

  • logins from countries or networks you don’t use;
  • logins at unusual times, or for users who shouldn’t log in (www-data, mysql, old accounts);
  • Accepted password when you only use keys;
  • gaps or truncated history (wtmp cleared), and last showing nothing while the server has been up for weeks.

If you see these, follow an incident checklist. See detect a compromised server.

Keep login records useful

  • Ship auth logs to another server, so an attacker can’t erase them locally.
  • Make sure logs rotate, but are kept long enough (several weeks to months). See logrotate.
  • Get alerts for successful root or admin logins (for example a PAM or SSH login hook that sends a message).

A weekly review habit

Once a week, spend two minutes on last -a | head -30 and lastlog -b 0 -t 7 (users who logged in during the last 7 days). You’ll quickly learn what normal looks like for your server, so anything unusual stands out. Remove accounts of people who no longer need access, and check that service accounts still show “Never logged in”.

Quick reference

Question Command
Recent logins last -a
Failed attempts sudo lastb
Each user’s last login lastlog
SSH details (key, IP) grep Accepted /var/log/auth.log
Reboots last reboot
Who’s on now w

Related: Linux server hardening checklist and disable root SSH login.

  • Linux
  • Security
  • SSH