AULAST(8)

👑 AULAST — the audit-log last, bestie edition ✨

okay so real quick, this is aulast(8) from the System Administration Utilities section, and it's basically last but with the receipts from your audit logs. sit down, grab a boba, let's get into it 💖

🌸 NAME 🌸

aulast — a program similar to last

✨ SYNOPSIS ✨

aulast [ options ]

🦋 DESCRIPTION 🦋

okay bestie, so aulast prints out a listing of the last logged in users, and it does it just like last and lastb do. the way it works is it searches back through the audit logs — or through whatever audit log file you hand it — and shows you a list of all the users who logged in (and out) based on the range of time sitting in those audit logs. 💅

and listen, you can also give it names of users and tty's, and in that case aulast will only show you the entries that match the arguments you gave. narrowing the vibes, as one does.

the pseudo user reboot logs in every single time the system reboots. so like, last reboot is gonna show you a log of all the reboots since the log file was created. iconic behaviour fr fr.

the main difference a user is gonna notice? aulast prints events from oldest to newest, while last prints records from newest to oldest. opposite directions, same energy. also, the audit system is not notified each time a tty or pty is allocated, so you may not see quite as many records indicating users and their tty's. not me breaking the news but that's just how it is 😭

💖 OPTIONS 💖

• --bad — report on the bad logins. the flops, if you will.
• --debug — print debug messages to stderr.
• --extract — write the raw audit records used to create the displayed report into a file named aulast.log in the current working directory.
• -f file — use the file instead of the audit logs for input.
• --proof — print out the audit event serial numbers used to determine the preceding line of the report. a serial number of 0 is a place holder and not an actual event serial number. these serial numbers can be used to examine the actual audit records in more detail. also, an ausearch query is printed that will let you find the audit records associated with that session. receipts on receipts, we love to see it 🔥
• --stdin — take audit records from stdin. the audit events must be in the raw format, no exceptions bestie.
• --tty tty — limit the report to a specific tty's activity. the names of ttys can be abbreviated. for example, 0 is the same as tty0. shorthand queen 👑
• --user name — limit the report to a specific user.

🎀 EXAMPLES 🎀

to see this month's logins:

ausearch --start this-month --raw | aulast --stdin

🌈 SEE ALSO 🌈

last(1), lastb(1), ausearch(8), aureport(8).

⭐ AUTHOR ⭐

Steve Grubb

and that's the whole page, bestie 🫶 this one's from Red Hat, dated June 2016, and the man page is AULAST(8). go log some stuff, stay audited, and remember: oldest to newest. periodt. 💅✨