Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a program that displays the login message formatted like this:

Last login: Wed Oct 24 16:40:33 2012

Or do I have to write my own program/script? I was wondering if there is a command the Linux kernel (or whoever) runs to do that.

share|improve this question
Check # man last (shows details of last logged in users). # echo last -n 2 root >> /etc/profile would show last 2 logged-in session for user 'root'. Is it that you was looking for? –  Mayura Oct 27 '12 at 20:24
No. I would like it to be in the format mentioned above. –  BenjiWiebe Oct 27 '12 at 20:25

2 Answers 2

The kernel does not track login information. You can configure PAM (/etc/pam.d) to call the pam_lastlog.so module, which shows exactly what you want:

session optional pam_lastlog.so noterm nohost

Or a bit more verbose:

session optional pam_lastlog.so

Or one that also prints failed logins:

session optional pam_lastlog.so showfailed

On Fedora, it might go to /etc/pam.d/system-login or /etc/pam.d/gdm-password, I'm not sure.

The information is stored in /var/log/wtmp and /var/log/lastlog.

share|improve this answer
Yes it has been showing it like that, but I have a custom MOTD script that scrolls it up out of sight. So I need to be able to output it from the end of my script. Good answer though. I just didn't explain my problem well enough. –  BenjiWiebe Oct 27 '12 at 20:17
@BenjiWiebe: Change the motd script to be displayed by pam_motd.so instead? If it must be different for every user, re-generate it with pam_exec.so. Put them above pam_lastlog.so in the "session" section. –  grawity Oct 27 '12 at 20:27
Hmmmm. Not sure what you mean/how to do it. –  BenjiWiebe Oct 27 '12 at 20:29
@BenjiWiebe: Why is the motd displayed by a script? Does it change with time, or does it change for different users? –  grawity Oct 27 '12 at 20:30
It is a colored, somewhat animated, script that changes per user and also changes as time goes by. –  BenjiWiebe Oct 27 '12 at 20:32
up vote 0 down vote accepted

I wrote some code to do it for me:

LINE=`lastlog -u $USER | head -n2 | tail -n1`;
WORDS=`echo "$LINE" | wc -w`;
if [ "x$WORDS" = "x9" ]; then
  echo "$LINE" | awk '{ printf "Last login: %s %s  %s %s %s from %s\n", $4, $5, $6, $7, $9, $3 }';
  echo "Unsupported case.";

It doesn't work for non-remote logins, but I am running the code on a headless server, so 99.9% of the logins will be remote logins; the other 0.1% will be when I "attach a head" to fix ssh issues or similar.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.