How to check user login history in Linux

Account reviews and incident handoffs often need a session timeline, not just confirmation that a user account exists. Login history shows when an account opened a terminal or remote session, how long the session lasted, and which host or IP address was recorded for the login.

The last command reads the login database written by the system's session stack. Traditional systems store records in /var/log/wtmp, while newer Debian and Ubuntu releases may provide last through wtmpdb and store the same class of records in /var/log/wtmp.db. The command syntax below keeps the remote host visible and uses ISO timestamps so the output can be compared with authentication logs and ticket times.

Login history is only as complete as the database and retention policy on that host. Empty output, missing files, or reboot-only records do not prove the account was never used, and failed attempts may live only in authentication logs on current distributions. Treat unexpected sessions as leads to corroborate with sshd, sudo, and account-management logs.

1. List recent sessions for the target account.

   $ last --limit 5 --hostlast --time-format iso admin
   admin    pts/0        2026-06-13T09:18:22+0000  - 2026-06-13T09:44:08+0000   (00:25)     203.0.113.10
   admin    pts/1        2026-06-12T22:06:41+0000  - 2026-06-12T22:19:03+0000   (00:12)     198.51.100.44
   
   wtmpdb begins 2026-06-12T02:00:00+0000

   Replace admin with the account name being reviewed. On legacy hosts the final line may say wtmp begins instead of wtmpdb begins.

2. Check whether the account was logged in at a specific time.

   $ last --present "2026-06-13 09:20:00" --limit 5 --time-format iso admin
   admin    pts/0        203.0.113.10     2026-06-13T09:18:22+0000  - 2026-06-13T09:44:08+0000   (00:25)
   
   wtmpdb begins 2026-06-12T02:00:00+0000

   --present is useful when a ticket, alert, or file timestamp needs an account session at one exact time.

3. Show active sessions that are still open.

   $ who --users
   admin    pts/0        2026-06-13 09:18 00:11        3142 (203.0.113.10)

   who reads the current-session database, while last reads historical session records.

4. Include reboot and shutdown records that may explain session gaps.

   $ last --system --limit 5 --time-format iso
   reboot   system boot  6.8.0-60-generic 2026-06-13T08:55:10+0000  - still running
   shutdown system down  6.8.0-60-generic 2026-06-13T08:50:03+0000  - 2026-06-13T08:55:10+0000   (00:05)
   
   wtmpdb begins 2026-06-12T02:00:00+0000

   --system adds boot, shutdown, and related system records. Some wtmpdb output may label soft reboot entries as s-reboot.

5. Check failed SSH login attempts in authentication logs.

   $ sudo journalctl _COMM=sshd --since "2026-06-13 00:00:00" --grep "Failed password"
   Jun 13 08:57:19 server sshd[3115]: Failed password for invalid user admin from 192.0.2.55 port 51244 ssh2

   lastb reads /var/log/btmp on systems that still ship it, but current distributions may not provide lastb. Use authentication logs for failed attempts when btmp tooling is unavailable.
   Related: How to check authentication logs in Linux

6. Confirm the retained login-history range before closing the review.

   $ last --limit 1 --time-format iso
   admin    pts/0        203.0.113.10     2026-06-13T09:18:22+0000  - 2026-06-13T09:44:08+0000   (00:25)
   
   wtmpdb begins 2026-06-12T02:00:00+0000

   The begins line is the lower bound of the visible database, not proof that no earlier sessions existed. Check rotated files, exported wtmpdb databases, central logs, or backups when the review needs older activity.