lastlog formats and prints the contents of the last login log /var/log/lastlog file. The login-name, port, and last login time will be printed. The default (no flags) causes lastlog entries to be printed, sorted by their order in /etc/passwd.
OPTIONS
The options which apply to the lastlog command are:
-h : Print help message and exit.
-t : Print the lastlog records more recent than DAYS.
-u : Print the lastlog record for user with specified LOGIN only.The -t flag overrides the use of -u.
Additional note:
If the user has never logged in the message **Never logged in** will be displayed instead of the port and time. The lastlog file is a database which contains info on the last login of each user. You should not rotate it. It is a sparse file, so its size on the disk is much smaller than the one shown by ls -l (which can indicate a really big file if you have a high UID). You can display its real size with ls -s.
Example
1. Find the last login for all user in the system.
# lastlog Username Port Latest at **Never logged in** bin **Never logged in** daemon **Never logged in** ftp **Never logged in** games **Never logged in** gdm **Never logged in** haldaemon **Never logged in** lp **Never logged in** mail **Never logged in** man **Never logged in** messagebus **Never logged in** news **Never logged in** ntp **Never logged in** postfix **Never logged in** root pts/0 Sun Apr 10 19:35:41 +0800 2011 sshd **Never logged in** suse-ncc **Never logged in** uucp **Never logged in** wwwrun **Never logged in** suseadm :0 Sun Apr 3 04:39:17 +0800 2011 smdadm **Never logged in** itsiti pts/1 Sun Mar 27 04:21:57 +0800 2011
2. Find the last login for user root only.
# lastlog -u root Username Port Latest root pts/0 Sun Apr 10 19:35:41 +0800 2011
