NAME

       aulast - a program similar to last

SYNOPSIS

       aulast [ options ]

DESCRIPTION

       aulast  is  a program that prints out a listing of the last logged in users similarly to the program last
       and lastb. Aulast searches back through the audit logs or the given audit log file and displays a list of
       all users logged in (and out) based on the range of time in the audit logs. Names of users and tty’s  can
       be given, in which case aulast will show only those entries matching the arguments.

       The  pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all
       reboots since the log file was created.

       The main difference that a user will notice is that aulast print events from oldest to newest, while last
       prints records from newest to oldest. Also, the audit system is not notified each time a tty  or  pty  is
       allocated, so you may not see quite as many records indicating users and their tty's.

OPTIONS

       --bad  Report on the bad logins.

       --debug
              Print debug messages to stderr.

       --extract
              Write  raw audit records used to create the displayed report into a file aulast.log in the current
              working directory.

       -f file
              Use the file instead of the audit logs for input.

       --proof
              Print out the audit event serial numbers used to determine the preceding line  of  the  report.  A
              Serial number of 0 is a place holder and not an actual event serial number. The serial numbers can
              be used to examine the actual audit records in more detail. Also an ausearch query is printed that
              will let you find the audit records associated with that session.

       --stdin
              Take audit records from stdin. The audit events must be in the raw format.

       --tty tty
              Limit  the report to a specific tty's activity. The names of ttys can be abbreviated. For example,
              0 is the same as tty0.

       --user name
              Limit the report to a specific user.

EXAMPLES

       To see this month's logins
       ausearch --start this-month --raw | aulast --stdin

SEE ALSO

       last(1), lastb(1), ausearch(8), aureport(8).

AUTHOR

       Steve Grubb

Red Hat                                             June 2016                                          AULAST(8)