View log of user log on system There are two types of logging user logon behavior, one is to record the data of the login, one is to record the user's logon time One, log the user login data /var/log/ The wtmp log file records the user's logged-on data. But this file is encoded file, not directly with the VI, cat and other commands to view, can be read with the last command. Each login will produce a record, including user name, login, time span and other information, as follows: www.2cto.com [html] [[email protected] ~]# last Root PTS/1 :0.0 Wed Oct 03:03 Still logged in root : 0 and nbsp wed Oct 03:02 still logged in root : 0 wed Oct 03:02-03:02 (00:00) reboot system boot 2.6.18-194.el5 Wed Oct 03:01 &NB SP; (00:01) root PTS/1 :0.0 &NBsp Mon Oct 01:00-03:09 (02:08) root : 0 mon Oct 01:00-03:09 (02:09) root : 0 &N Bsp mon Oct 01:00-01:00 (00:00) reboot system boot 2.6.18-194.el5 Mon OCT 00:58 (02:10) root PTS/3 :0.0 Sat Oct 18:59-00:41 (05:41) root   ; PTS/2 :0.0 Sat Oct 18:34-00:41 (06: root PTS/1 :0.0 Sat Oct 1318:33-00:41 (06:08) root : 0 &NB Sp sat Oct 18:32-00:41 (06:08) root : 0 sat Oct 13 18:32-18:32 (00:00) reboot system boot 2.6.18-194.el5 Sat Oct 18:31 &NB Sp (06:09) root PTS/1 :0.0 &NB Sp Thu Oct 20:12-03:17 (07:04) root : 0 thu Oct 20:12-03:17 (07:05) root : 0 &N Bsp Thu Oct20:12-20:12 (00:00) www.2cto.com Two, view specific user login /var/log/lastlog log file Logs the most recent logon times for each user. Only one record per user [html] [[email protected] ~]# lastlog username Port F Rom Latest root : 0 wed Oct 03:02:36-0700 bin &nbs P , &NB Sp;**never logged in** daemon &N Bsp **never logged in** adm and nbsp **never logged in** lp , &N Bsp **never logged in** sync **never logged in** shutdown &NB Sp **never logged in** halt **never Lo Gged in** mail &NB Sp **never logged in** news **never logged in**  UUCP &NBSP **never logged in** &nbs P;operator **never logged in** games &NBSP ; **never logged in** gopher **never logged in** ftp , &NB Sp **never logged in** nobody **never logged in** nscd **never logged in**  VCSA **never Lo Gged in** oprofile **never logged in** pcap **never logged in** ntp **never Log Ged in** dbus &NBS P **never logged in** avahi **never logged in** rpc & nbsp **never logged in** apache , &N Bsp **never logged in** mailnull &NB Sp **never logged in** smmsp **never logged in** sshd **never Lo Gged in** xfs &NBS P **never logged in** rpcuser &NBS P **never logged in** haldaemon &NB Sp **never logged in** avahi- AUTOIPD **never Lo Gged in**  GDM &NBS P **never logged in**
Linux to view logon logs for system users