List failed login attempts with `lastb`

The forgotten counterpart of `last`: lastb reads /var/log/btmp and shows every failed login — the quickest way to see whether your SSH server is being brute-forced.

LinuxloginssshlastbauditMedium risk

Run `sudo lastb | head -30` to show the most recent failed logins with username, source IP and timestamp.

01Command

Command

$ sudo lastb | head -30

02What it does

While `last` reads /var/log/wtmp for successful logins, `lastb` reads the companion file btmp where failed attempts are logged. On any public-facing SSH server, pages of entries with usernames like admin, root and test from random IPs are normal brute-force noise — what matters is repeated failures that suddenly succeed. Useful forgotten flags: `lastb -n 50` to limit lines, `lastb root` to filter by user, and `lastb -s '2026-09-01'` to start at a date.

03Risk

RiskMedium risk

RequirementsReads /var/log/btmp (root-only); part of the sysvinit-utils/util-linux wtmp package, preinstalled on most distros

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

last(1), lastb(1) — list logins, lastb lists bad logins
Ubuntu Manpages · technical · 2026-09-17
Evidence: Documents lastb as reading /var/log/btmp to show failed login attempts, with user/host/time columns

Last verified: 2026-09-17 · Category: Security & Privacy