I am a Fedora Linux user (SysAdmin) and I would like to clear all the login information. How do I clear or remove last login information on Linux operating systems?
The /var/log/lastlog file stores user last login information. This is binary file and act as database times of previous user logins. You need to use lastlog command to formats and prints the contents of the last login log /var/log/lastlog file.
lastlog command
The lastlog command shows the most recent login of all users or of a given user. The Following information is printed using lastlog command:
=> The login-name
=> Port
=> Last login time
Task: Display last login information
Simply type the lastlog command :
$ lastlog
Sample outputs:
Username Port From Latest root tty1 Thu Jan 25 15:23:50 +0530 2007 daemon **Never logged in** bin **Never logged in** sys **Never logged in** sync **Never logged in** vivek tty1 Sat Jan 27 22:10:36 +0530 2007 pdnsd **Never logged in** sshd **Never logged in** messagebus **Never logged in** bind **Never logged in** sweta tty1 Sat Jan 27 19:55:22 +0530 2007
Note: If the user has never logged in the message “**Never logged in**” will be displayed instead of the port and time.
Task: Clear last login information by deleting /var/log/lastlog
Simply overwrite /var/log/lastlog file. You must be the root user. First make a backup of /var/log/lastlog:
# cp /var/log/lastlog /root
Now overwrite file using any one of the following command:
# >/var/log/lastlog
OR
# cat > /var/log/lastlog
Press CTR+D to save the changes.
last and lastb commands
Use last or lastb command to display listing of last logged in users:
$ last
OR
$ lastb
Sample outputs:
root pts/1 10.1.6.120 Tue Jan 7 16:43 still logged in root pts/0 10.1.6.120 Tue Jan 7 15:52 still logged in root pts/0 10.1.6.120 Tue Jan 7 11:20 - 15:07 (03:47) root pts/1 10.1.6.120 Tue Jan 7 07:07 - 09:50 (02:43) root pts/0 10.1.6.120 Tue Jan 7 05:00 - 07:22 (02:21) root pts/0 10.1.6.120 Mon Jan 6 14:16 - 16:36 (02:20) root pts/0 10.1.6.120 Sun Jan 5 16:37 - 17:01 (00:23) root pts/0 10.1.6.120 Sun Jan 5 15:12 - 15:39 (00:26) root pts/0 10.1.6.120 Sun Jan 5 14:45 - 15:05 (00:20) root pts/2 10.1.6.120 Sun Jan 5 12:53 - 15:46 (02:53) root pts/0 10.1.6.120 Sun Jan 5 12:52 - 12:53 (00:00) root pts/1 10.1.6.120 Sun Jan 5 11:09 - 14:29 (03:20) root pts/0 10.1.6.120 Sun Jan 5 10:05 - 12:19 (02:14) reboot system boot 2.6.32-431.3.1.e Sun Jan 5 10:02 - 16:48 (2+06:46) root pts/0 10.1.6.120 Sun Jan 5 09:58 - down (00:00) root pts/0 10.1.6.120 Sun Jan 5 03:33 - 05:45 (02:12) root pts/1 10.1.6.120 Sat Jan 4 15:06 - 17:28 (02:21) root pts/0 10.1.6.120 Sat Jan 4 13:46 - 15:58 (02:11) root pts/0 10.1.6.120 Sat Jan 4 05:05 - 07:16 (02:11) root pts/1 10.1.6.120 Fri Jan 3 14:29 - 15:44 (01:15) root pts/0 10.1.6.120 Fri Jan 3 13:20 - 15:32 (02:11) root pts/0 10.1.6.120 Thu Jan 2 05:19 - 05:32 (00:13) root pts/0 10.1.6.120 Tue Dec 31 13:57 - 16:06 (02:09) wtmp begins Tue Dec 31 13:57:23 2013
last and lastb use /var/log/wtmp and /var/log/btmp files to log information. You can use the following command to clear wtmp/btmp:
# >/var/log/wtmp
# >/var/log/btmp
For more information see man pages – wtmp(5)
