NAME
aulast - a program similar to last
SYNOPSIS
aulast [ options ] [ user ] [ tty ]
DESCRIPTION
aulast is a program that prints out a listing of the last logged in
users similarly to the program last and lastb. Aulast searches back
through the audit logs or the given audit log file and displays a list
of all users logged in (and out) based on the range of time in the
audit logs. Names of users and ttyâ The pseudo user reboot logs in each
time the system is rebooted. Thus last reboot will show a log of all
reboots since the log file was created.
The main difference that a user will notice is that aulast print events
from oldest to newest, while last prints records from newest to oldest.
Also, the audit system is not notified each time a tty or pty is
allocated, so you may not see quite as many records indicating users
and their tty’s.
OPTIONS
--bad Report on the bad logins.
--extract
Write raw audit records used to create the displayed report into
a file aulast.log in the current working directory.
-f file
Use the file instead of the audit logs for input.
--proof
Print out the audit event serial numbers used to determine the
preceeding line of the report. A Serial number of 0 is a place
holder and not an actual event serial number. The serial numbers
can be used to examine the actual audit records in more detail.
Also an ausearch query is printed that will let you find the
audit records associated with that session.
--stdin
Take audit records from stdin.
EXAMPLES
To see this month’s logins
ausearch --start this-month --raw | aulast --stdin
SEE ALSO
last(1), lastb(1), ausearch(8), aureport(8).
AUTHOR
Steve Grubb