1AULAST:(8)              System Administration Utilities             AULAST:(8)
2
3
4

NAME

6       aulast - a program similar to last
7

SYNOPSIS

9       aulast [ options ] [ user ] [ tty ]
10
11

DESCRIPTION

13       aulast  is  a  program  that prints out a listing of the last logged in
14       users similarly to the program last and  lastb.  Aulast  searches  back
15       through  the audit logs or the given audit log file and displays a list
16       of all users logged in (and out) based on the  range  of  time  in  the
17       audit logs. Names of users and tty’s can be given, in which case aulast
18       will show only those entries matching the arguments. Names of ttys  can
19       be abbreviated, thus aulast 0 is the same as last tty0.
20
21       The  pseudo  user reboot logs in each time the system is rebooted. Thus
22       last reboot will show a log of all reboots since the log file was  cre‐
23       ated.
24
25       The main difference that a user will notice is that aulast print events
26       from oldest to newest, while last prints records from newest to oldest.
27       Also,  the audit system is not notified each time a tty or pty is allo‐
28       cated, so you may not see quite as many records  indicating  users  and
29       their tty's.
30
31

OPTIONS

33       --bad  Report on the bad logins.
34
35
36       --extract
37              Write raw audit records used to create the displayed report into
38              a file aulast.log in the current working directory.
39
40
41       -f file
42              Use the file instead of the audit logs for input.
43
44
45       --proof
46              Print out the audit event serial numbers used to  determine  the
47              preceeding  line  of the report. A Serial number of 0 is a place
48              holder and not an actual event serial number. The serial numbers
49              can  be used to examine the actual audit records in more detail.
50              Also an ausearch query is printed that will  let  you  find  the
51              audit records associated with that session.
52
53
54       --stdin
55              Take audit records from stdin.
56
57

EXAMPLES

59       To see this month's logins
60       ausearch --start this-month --raw | aulast --stdin
61
62

SEE ALSO

64       last(1), lastb(1), ausearch(8), aureport(8).
65
66

AUTHOR

68       Steve Grubb
69
70
71
72Red Hat                            Nov 2008                         AULAST:(8)