dwww Home | Manual pages | Find package

AULAST(8)               System Administration Utilities               AULAST(8)

NAME
       aulast - a program similar to last

SYNOPSIS
       aulast [ options ]

DESCRIPTION
       aulast  is  a  program  that  prints out a listing of the last logged in
       users similarly to the program last  and  lastb.  Aulast  searches  back
       through  the  audit logs or the given audit log file and displays a list
       of all users logged in (and out) based on the range of time in the audit
       logs. Names of users and tty’s can be given, in which case  aulast  will
       show only those entries matching the arguments.

       The  pseudo  user  reboot logs in each time the system is rebooted. Thus
       last reboot will show a log of all reboots since the log file  was  cre-
       ated.

       The  main difference that a user will notice is that aulast print events
       from oldest to newest, while last prints records from newest to  oldest.
       Also,  the  audit system is not notified each time a tty or pty is allo-
       cated, so you may not see quite as many  records  indicating  users  and
       their tty's.

OPTIONS
       --bad  Report on the bad logins.

       --debug
              Print debug messages to stderr.

       --extract
              Write  raw audit records used to create the displayed report into
              a file aulast.log in the current working directory.

       -f file
              Use the file instead of the audit logs for input.

       --proof
              Print out the audit event serial numbers used  to  determine  the
              preceding  line  of  the  report. A Serial number of 0 is a place
              holder and not an actual event serial number. The serial  numbers
              can  be  used to examine the actual audit records in more detail.
              Also an ausearch query is printed that will let you find the  au-
              dit records associated with that session.

       --stdin
              Take  audit  records  from stdin. The audit events must be in the
              raw format.

       --tty tty
              Limit the report to a specific tty's activity. The names of  ttys
              can be abbreviated. For example, 0 is the same as tty0.

       --user name
              Limit the report to a specific user.

EXAMPLES
       To see this month's logins
       ausearch --start this-month --raw | aulast --stdin

SEE ALSO
       last(1), lastb(1), ausearch(8), aureport(8).

AUTHOR
       Steve Grubb

Red Hat                            June 2016                          AULAST(8)

Generated by dwww version 1.16 on Tue Dec 16 05:55:24 CET 2025.