LASTLOG(8)

💖 LASTLOG(8) 💖

okay bestie, gather round, because this one is literally the receipts of who logged in last. it's lastlog, it lives in the System Management Commands corner of the manual, and it is lowkey iconic.

---

✨ NAME ✨

lastlog — reports the most recent login of all users or of a given user 🫶

---

🌸 SYNOPSIS 🌸

lastlog [options]

---

🦋 DESCRIPTION 🦋

so what does she actually do? lastlog formats and prints the contents of the last login log — that's the /var/log/lastlog file, no cap. the login-name, the port, and the last login time all get printed. 🎀

the default (like, zero flags, just vibes) causes lastlog entries to be printed, sorted by their order in /etc/passwd. periodt.

---

💅 OPTIONS 💅

these are the options that apply to the lastlog command, and yes we're going through every single one:

• -b, --before DAYS — print only lastlog records older than DAYS. it's giving "show me the ancients". 💀
• -C, --clear — clear lastlog record of a user. bestie, this option can be used only together with -u (--user)). don't try it solo, she will not cooperate.
• -h, --help — display help message and exit. the classic "help me please" move. 🙈
• -R, --root CHROOT_DIR — apply changes in the CHROOT_DIR directory and use the configuration files from the CHROOT_DIR directory. only absolute paths are supported, so no shortcuts bestie. 🚫
• -S, --set — set lastlog record of a user to the current time. this one can be used only together with -u (--user)). same rule as -C, she's not a solo act. ✨
• -t, --time DAYS — print the lastlog records more recent than DAYS. main character energy only. 👑
• -u, --user LOGIN|RANGE — print the lastlog record of the specified user(s).

the users can be specified by a login name, a numerical user ID, or a RANGE of users. and this RANGE of users can be specified with a min and max values (UID_MIN-UID_MAX), a max value (-UID_MAX), or a min value (UID_MIN-). pick your fighter. 🌈

if the user has never logged in, the message ** Never logged in** will be displayed instead of the port and time. ghosted by your own login history fr fr. 😭

only the entries for the current users of the system will be displayed. other entries may exist for users that were deleted previously — so yeah, there's lore in there. 💀

---

📝 NOTE 📝

the lastlog file is a database which contains info on the last login of each user. you should not rotate it. do not. nope. 🛑

it's a sparse file, so its size on the disk is usually much smaller than the one shown by ls -l — which can indicate a really big file if you have in passwd users with a high UID. the way that number lies to you is honestly rude. 🙈

you can display its real size with ls -s. use that one instead, iykyk. 💖

---

⚙️ CONFIGURATION ⚙️

the following configuration variables in /etc/login.defs change the behavior of this tool:

LASTLOG_UID_MAX (number) 🎀

highest user ID number for which the lastlog entries should be updated. as higher user IDs are usually tracked by remote user identity and authentication services, there is no need to create a huge sparse lastlog file for them. like, why would you. 🌸

no LASTLOG_UID_MAX option present in the configuration means that there is no user ID limit for writing lastlog entries.

---

📂 FILES 📂

• /var/log/lastlog — database times of previous user logins. this is the file, the whole plot. 🌟

---

⚠️ CAVEATS ⚠️

large gaps in UID numbers will cause the lastlog program to run longer with no output to the screen — i.e. if in lastlog database there is no entries for users with UID between 170 and 800, lastlog will appear to hang as it processes entries with UIDs 171-799. it's not frozen bestie, she's just going through it. 🫠

having high UIDs can create problems when handling the /var/log/lastlog with external tools. although the actual file is sparse and does not use too much space, certain applications are not designed to identify sparse files by default and may require a specific option to handle them. so like, read the docs before you blame the file. 💜

---

ok that's the whole page, every option, every number, every caveat, nothing skipped, we ate and left no crumbs 💅✨

this lil masterpiece is from shadow-utils 4.13, dated 05/30/2024 — and LASTLOG(8) said what she said. bye bestie, go check your login history 🦋🎀💖