1AULAST:(8)              System Administration Utilities             AULAST:(8)
2
3
4

NAME

6       aulast - a program similar to last
7

SYNOPSIS

9       aulast [ options ] [ user ] [ tty ]
10
11

DESCRIPTION

13       aulast  is  a  program  that prints out a listing of the last logged in
14       users similarly to the program last and  lastb.  Aulast  searches  back
15       through  the audit logs or the given audit log file and displays a list
16       of all users logged in (and out) based on the  range  of  time  in  the
17       audit logs. Names of users and tty’s can be given, in which case aulast
18       will show only those entries matching the arguments. Names of ttys  can
19       be abbreviated, thus aulast 0 is the same as last tty0.
20
21       The  pseudo  user reboot logs in each time the system is rebooted. Thus
22       last reboot will show a log of all reboots since the log file was  cre‐
23       ated.
24
25       The main difference that a user will notice is that aulast print events
26       from oldest to newest, while last prints records from newest to oldest.
27       Also,  the audit system is not notified each time a tty or pty is allo‐
28       cated, so you may not see quite as many records  indicating  users  and
29       their tty's.
30
31

OPTIONS

33       --bad  Report on the bad logins.
34
35
36       --extract
37              Write raw audit records used to create the displayed report into
38              a file aulast.log in the current working directory.
39
40
41       -ffile Use the file instead of the audit logs for input.
42
43
44       --proof
45              Print out the audit event serial numbers used to  determine  the
46              preceding  line  of  the report. A Serial number of 0 is a place
47              holder and not an actual event serial number. The serial numbers
48              can  be used to examine the actual audit records in more detail.
49              Also an ausearch query is printed that will  let  you  find  the
50              audit records associated with that session.
51
52
53       --stdin
54              Take audit records from stdin.
55
56

EXAMPLES

58       To see this month's logins
59       ausearch --start this-month --raw | aulast --stdin
60
61

SEE ALSO

63       last(1), lastb(1), ausearch(8), aureport(8).
64
65

AUTHOR

67       Steve Grubb
68
69
70
71Red Hat                            Nov 2008                         AULAST:(8)