The Linux system stores login attempts of all users in a file called “wtmp“. Typically this file will be located in “/var/log” directory. The Linux command line utility “last” can be used to list the currently logged in users as well as their previous logins. The plain usage of the command without any arguments displays information about all users of the system.

[nick@techpulp ~]# last
nick     pts/4        :0               Thu Jan 29 21:59   still logged in
neo      pts/3        :0               Thu Jan 29 21:59   still logged in
reboot   system boot  2.6.10.5-1.fc2   Thu Jan  1 17:39          (01:38)
liz      pts/3        :0               Thu Jan  1 16:39 - crash  (01:00)
liz      pts/2        :0               Thu Jan  1 16:38 - crash  (01:01)
liz      pts/1        :0               Thu Jan  1 16:36 - crash  (01:03)
reboot   system boot  2.6.10.5-1.fc2   Thu Jan  1 19:56          (-5:-16)

wtmp begins Thu Jan  1 19:56:45 2009
[nick@techpulp ~]#

This information also contains information about the last system reboot as you can notice a special user “reboot” logged in whenever system is going to be rebooted.

The “last” command also takes arguments like user name or tty name to display only the matching information.

[nick@techpulp ~]# last liz
liz      pts/3        :0               Thu Jan  1 16:39 - crash  (01:00)
liz      pts/2        :0               Thu Jan  1 16:38 - crash  (01:01)
liz      pts/1        :0               Thu Jan  1 16:36 - crash  (01:03)

wtmp begins Thu Jan  1 19:56:45 2009
[nick@techpulp ~]#

You can also look at other command “w” which displays information about currently logged in users, what they are doing and how long they are idle.