List Last Login Times for All Users with lastlog
Print one line per system account showing when it last logged in — or 'Never logged in' for accounts nobody has used.
Run lastlog to report the most recent login of every user, or lastlog -u alice to check a single account.
01Command
Command
$ lastlog02What it does
lastlog reads /var/log/lastlog, where login programs stamp each user's last session time, and formats it as a tidy table alongside port and origin host. It complements last: last shows a chronological session history, while lastlog answers per-account questions like 'has this service account ever been used?'. -b N restricts output to logins older than N days — exactly what you want before disabling stale accounts.
03Risk
!Warning: A huge Never-logged-in tail is normal on systems with many service/system accounts — filter with lastlog -u or grep to focus on real users.
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- lastlog(8) — Linux manual pageEvidence: lastlog man page: 'lastlog - reports the most recent login of all users or of a given user' with -u and -b options.
Last verified: 2026-09-17 · Category: Security & Privacy