lastlog

Install

# Typically included in the shadow-utils package

# RHEL / Alma / Rocky
sudo dnf install shadow-utils

# Debian / Ubuntu
sudo apt install passwd

# openSUSE
sudo zypper install shadow

# Arch
sudo pacman -S shadow

What it does

lastlog displays the most recent login time, terminal, and source IP for each user account. It reads from the binary file /var/log/lastlog.

How it works (mechanical)

• Reads fixed-size binary records from /var/log/lastlog.
• Records are indexed by user ID (UID).
• Only updates when a successful login occurs.
• Does not track failed attempts (see faillog or faillock).
• Output may be sparse on systems with high UID ranges.

Quick Start

# Show last login info for all users
lastlog

10 Practical Examples

# 1) Show all users' last login records
lastlog

# 2) Show last login for a specific user
lastlog -u username

# 3) Show users who have never logged in
lastlog | grep "Never logged in"

# 4) Filter output for active human users
lastlog | grep -v "Never logged in"

# 5) Combine with sort by date (basic text sort)
lastlog | sort

# 6) Check last login before disabling an account
lastlog -u olduser

# 7) Audit service accounts (often show "Never logged in")
lastlog -u daemon

# 8) Pair with id to verify UID mapping
id username
lastlog -u username

# 9) Inspect the raw file location (do not edit manually)
ls -lh /var/log/lastlog

# 10) Cross-check with who for current sessions
who
lastlog -u $(whoami)

Notes & Gotchas

• Binary log file — never edit directly.
• Large UID ranges can make the file appear very large (sparse file behavior).
• Does not track login history — only the most recent login.
• For full session history, use last (reads /var/log/wtmp).
• May require root privileges to view all user records.

Historical Context

lastlog has long been part of traditional Unix account management. It provided administrators with a quick way to see account usage without parsing full login history logs.

Modern Equivalent

lastlog is still standard for quick last-login checks. For more comprehensive auditing, administrators use last, journalctl, or centralized logging systems.

Related Commands

• last — show login session history.
• faillog — track failed login attempts.
• who — show currently logged-in users.
• w — show who is logged in and what they are doing.
• id — display user identity and group information.