Provided by: auditd_2.4.5-1ubuntu2_i386 bug

NAME

       aulast - a program similar to last

SYNOPSIS

       aulast [ options ] [ user ] [ tty ]

DESCRIPTION

       aulast  is  a  program  that prints out a listing of the last logged in
       users similarly to the program last and  lastb.  Aulast  searches  back
       through  the audit logs or the given audit log file and displays a list
       of all users logged in (and out) based on the  range  of  time  in  the
       audit logs. Names of users and tty’s can be given, in which case aulast
       will show only those entries matching the arguments. Names of ttys  can
       be abbreviated, thus aulast 0 is the same as last tty0.

       The  pseudo  user reboot logs in each time the system is rebooted. Thus
       last reboot will show a log of all  reboots  since  the  log  file  was
       created.

       The main difference that a user will notice is that aulast print events
       from oldest to newest, while last prints records from newest to oldest.
       Also,  the  audit  system  is  not  notified  each time a tty or pty is
       allocated, so you may not see quite as many  records  indicating  users
       and their tty's.

OPTIONS

       --bad  Report on the bad logins.

       --extract
              Write raw audit records used to create the displayed report into
              a file aulast.log in the current working directory.

       -ffile Use the file instead of the audit logs for input.

       --proof
              Print out the audit event serial numbers used to  determine  the
              preceding  line  of  the report. A Serial number of 0 is a place
              holder and not an actual event serial number. The serial numbers
              can  be used to examine the actual audit records in more detail.
              Also an ausearch query is printed that will  let  you  find  the
              audit records associated with that session.

       --stdin
              Take audit records from stdin.

EXAMPLES

       To see this month's logins
       ausearch --start this-month --raw | aulast --stdin

SEE ALSO

       last(1), lastb(1), ausearch(8), aureport(8).

AUTHOR

       Steve Grubb