View User Logon records in Linux and user logon records in linux

View User Logon records in Linux and user logon records in linux

User logon information is recorded in utmp (/var/run/utmp), wtmp (/var/log/wtmp), and btmp (/var/log/btmp) and lastlog (/var/log/lastlog) files.

Commands such as who, w, and users query the information of the currently logged on user through the utmp (/var/run/utmp) file.
The last and ac commands use the wtmp (/var/log/wtmp) file to query the information of current and past users logging on to the system.
The lastb command uses the btmp (/var/log/btmp) file to query information of all users who failed to log on to the system.
The lastlog command uses the lastlog (/var/log/lastlog) file to query the user's last logon information.

 

Who command: displays the information of the currently logged on user

huey@huey-K42JE:~$ whohuey     pts/1        2015-05-11 18:29 (192.168.1.105)sugar    pts/2        2015-05-11 18:29 (192.168.1.105)

W command: displays the logged-on user and the tasks currently executed

huey@huey-K42JE:~$ w 18:30:51 up 3 min,  2 users,  load average: 0.10, 0.14, 0.06USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAThuey     pts/1    192.168.1.105    18:29    3.00s  0.52s  0.00s wsugar    pts/2    192.168.1.105    18:29    1:07   0.47s  0.47s -bash

Users command: displays the username of the currently logged-on user.

huey@huey-K42JE:~$ usershuey sugar

Last Command: displays information about the current and past users logging on to the system.

huey@huey-K42JE:~$ lastroot     pts/3        192.168.1.105    Mon May 11 18:33 - 18:33  (00:00)    sugar    pts/2        192.168.1.105    Mon May 11 18:32   still logged in   sugar    pts/2        192.168.1.105    Mon May 11 18:29 - 18:32  (00:02)    huey     pts/1        192.168.1.105    Mon May 11 18:29   still logged in   reboot   system boot  3.5.0-43-generic Mon May 11 18:27 - 18:33  (00:05)    huey     pts/1        192.168.1.105    Sat May  9 10:57 - 17:31  (06:33)

Lastb command: displays information about all users who failed to log on to the system.

huey@huey-K42JE:~$ sudo lastbbtmp begins Sat May  9 09:48:59 2015

Lastlog command: displays the last user login information

Huey-K42JE :~ $LastlogUser name port comes from the last login time root pts/3 192.168.1.105 May 11 18:36:43 + 0800 2015 daemon ** never logged on ** bin ** never logged on ** sys ** never logged on * *...... you have never logged on to ** saned ** or ** huey pts/1 192.168.1.105 at 18:29:40 + 0800 2015guest-mIZNkv ** and have never logged on to ** guest-bCf1SI **. ** sugar pts/2 192.168.1.105 18:32:28 + 0800 2015 mysql ** never logged on ** sshd ** never logged on **

Ac command: displays the user connection time statistics
A) display the total connection time of each day

huey@huey-K42JE:~$ ac -dMay  9total        6.55Todaytotal        0.54

B) display the total connection time of each user

huey@huey-K42JE:~$ ac -phuey                                 6.78sugar                                0.23root                                 0.12total        7.13