Man Pages

aulast(8) - phpMan aulast(8) - phpMan

Command: man perldoc info search(apropos)  

AULAST:(8)              System Administration Utilities             AULAST:(8)

       aulast - a program similar to last

       aulast [ options ] [ user ] [ tty ]

       aulast  is  a  program  that prints out a listing of the last logged in users similarly to the program last and
       lastb. Aulast searches back through the audit logs or the given audit log file and displays a list of all users
       logged  in  (and  out) based on the range of time in the audit logs. Names of users and tty's can be given, in
       which case aulast will show only those entries matching the arguments. Names of ttys can be  abbreviated,  thus
       aulast 0 is the same as last tty0.

       The  pseudo  user  reboot  logs  in  each  time the system is rebooted. Thus last reboot will show a log of all
       reboots since the log file was created.

       The main difference that a user will notice is that aulast print events  from  oldest  to  newest,  while  last
       prints  records  from  newest to oldest. Also, the audit system is not notified each time a tty or pty is allo-
       cated, so you may not see quite as many records indicating users and their tty's.

       --bad  Report on the bad logins.

              Write raw audit records used to create the displayed report into a file aulast.log in the current  work-
              ing directory.

       -ffile Use the file instead of the audit logs for input.

              Print  out  the  audit event serial numbers used to determine the preceding line of the report. A Serial
              number of 0 is a place holder and not an actual event serial number. The serial numbers can be  used  to
              examine  the  actual  audit  records in more detail. Also an ausearch query is printed that will let you
              find the audit records associated with that session.

              Take audit records from stdin.

       To see this month's logins
       ausearch --start this-month --raw | aulast --stdin

       last(1), lastb(1), ausearch(8), aureport(8).

       Steve Grubb

Red Hat                            Nov 2008                         AULAST:(8)