三个命令:last lastb lastlog
#显示用户登录的详细信息,包括时间和登录ip
[root@localhost ~]# last
root pts/0 192.168.25.100 Mon Nov 11 13:20 still logged in
root pts/1 192.168.25.100 Mon Nov 11 11:44 - 12:01 (00:17)
root pts/1 192.168.25.100 Mon Nov 11 10:14 - 10:14 (00:00)
root pts/0 192.168.25.100 Mon Nov 11 08:51 - 11:04 (02:13)
root pts/1 192.168.25.100 Sun Nov 10 18:36 - 20:09 (01:32)
root pts/1 192.168.25.100 Sat Nov 9 19:13 - 18:36 (23:22)
root pts/0 192.168.25.100 Sat Nov 9 17:02 - 20:09 (1+03:06)
root pts/0 192.168.25.100 Sat Nov 9 17:02 - 17:02 (00:00)
root pts/1 192.168.25.100 Sat Nov 9 16:03 - 19:13 (03:09)
root pts/0 192.168.25.100 Sat Nov 9 12:53 - 17:02 (04:08)
root pts/0 192.168.25.100 Sat Nov 9 10:49 - 11:55 (01:05)
#显示登录失败的记录
[root@localhost ~]# lastb
btmp begins Thu Nov 7 22:49:01 2019
#显示最后一次登录的信息
[root@localhost ~]# lastlog
用户名 端口 来自 最后登陆时间
root pts/0 192.168.25.100 一 11月 11 13:20:17 +0800 2019
bin **从未登录过**
daemon **从未登录过**
adm **从未登录过**
lp **从未登录过**
sync **从未登录过**
shutdown **从未登录过**
halt **从未登录过**
mail **从未登录过**
operator **从未登录过**
games **从未登录过**
ftp **从未登录过**
nobody **从未登录过**
systemd-network **从未登录过**
dbus **从未登录过**
polkitd **从未登录过**
sshd **从未登录过**
postfix **从未登录过**
chrony **从未登录过**
ntp **从未登录过**
www **从未登录过**
mysql **从未登录过**
