Linux lastb Command
The lastb command in Linux is used to list information about users who have failed to log into the system.
When executed alone, the lastb command reads the file named btmp located in the /var/log directory and displays all the usernames from that file that failed to log in.
Syntax
lastb [-adRx][-f <logfile>][-n <number of lines>][username...][terminal ID...]
Parameter Description:
options:
-R Omit the hostname column.
-a Display the host name or IP address from where the system was logged into in the last line.
-d Convert IP addresses to host names.
-f<logfile> Specify the log file.
-n<number of lines> or -<number of lines> Display the specified number of lines.
-R Do not display the hostname or IP address of the system logged into.
-x Display system shutdown, reboot, and change of execution level information.
username:
- username: Display login information for the specified user.
tty:
- tty Specify the login terminal; tty names can be abbreviated,
last 0is the same aslast tty0.
Example
Display information about users who failed to log in:
# lastb
...
zgg ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00)
zgg ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00)
zf ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00)
za ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00)
zeng ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00)
zf ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00)
zette ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00)
z310 ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00)
btmp begins Fri Apr 1 07:38:45 2022
Display 5 lines of information about users who failed to log in:
# lastb -n 5
mos ssh:notty 194.31.98.204 Thu Apr 28 16:52 - 16:52 (00:00)
user ssh:notty 194.31.98.204 Thu Apr 28 16:52 - 16:52 (00:00)
user ssh:notty 194.31.98.204 Thu Apr 28 16:52 - 16:52 (00:00)
user ssh:notty 194.31.98.204 Thu Apr 28 16:52 - 16:52 (00:00)
user ssh:notty 194.31.98.204 Thu Apr 28 16:52 - 16:52 (00:00)
btmp begins Fri Apr 1 07:38:45 2022