1AULAST(8)               System Administration Utilities              AULAST(8)
2
3
4

NAME

6       aulast - a program similar to last
7

SYNOPSIS

9       aulast [ options ]
10
11

DESCRIPTION

13       aulast  is  a  program  that prints out a listing of the last logged in
14       users similarly to the program last and  lastb.  Aulast  searches  back
15       through  the audit logs or the given audit log file and displays a list
16       of all users logged in (and out) based on the range of time in the  au‐
17       dit  logs.  Names of users and tty’s can be given, in which case aulast
18       will show only those entries matching the arguments.
19
20       The pseudo user reboot logs in each time the system is  rebooted.  Thus
21       last  reboot will show a log of all reboots since the log file was cre‐
22       ated.
23
24       The main difference that a user will notice is that aulast print events
25       from oldest to newest, while last prints records from newest to oldest.
26       Also, the audit system is not notified each time a tty or pty is  allo‐
27       cated,  so  you  may not see quite as many records indicating users and
28       their tty's.
29
30

OPTIONS

32       --bad  Report on the bad logins.
33
34
35       --debug
36              Print debug messages to stderr.
37
38
39       --extract
40              Write raw audit records used to create the displayed report into
41              a file aulast.log in the current working directory.
42
43
44       -f file
45              Use the file instead of the audit logs for input.
46
47
48       --proof
49              Print  out  the audit event serial numbers used to determine the
50              preceding line of the report. A Serial number of 0  is  a  place
51              holder and not an actual event serial number. The serial numbers
52              can be used to examine the actual audit records in more  detail.
53              Also an ausearch query is printed that will let you find the au‐
54              dit records associated with that session.
55
56
57       --stdin
58              Take audit records from stdin. The audit events must be  in  the
59              raw format.
60
61
62       --tty tty
63              Limit the report to a specific tty's activity. The names of ttys
64              can be abbreviated. For example, 0 is the same as tty0.
65
66
67       --user name
68              Limit the report to a specific user.
69
70

EXAMPLES

72       To see this month's logins
73       ausearch --start this-month --raw | aulast --stdin
74
75

SEE ALSO

77       last(1), lastb(1), ausearch(8), aureport(8).
78
79

AUTHOR

81       Steve Grubb
82
83
84
85Red Hat                            June 2016                         AULAST(8)