YouTip

# Linux lastb Command [ Linux Command Manual](#) The Linux **lastb** command is used to list information related to users who failed to log into the system. When executed alone, the `lastb` command reads the file named **btmp** located in the **/var/log** directory and displays all the usernames recorded in that file that failed to log in. ### Syntax lastb [username...][tty...] **Parameter Description**: options: * -R Omit the hostname column. * -a Display the hostname or IP address from which the login was attempted on the last line. * -d Convert IP addresses to hostnames. * -f Specify the record file. * -n or - Display the specified number of lines. * -R Do not display the hostname or IP address from which the login was attempted. * -x Display system shutdown, reboot, and runlevel change information. username: * username: Display login information for the specified user `username`. tty: * tty Set the login terminal. The tty name can be abbreviated; `last 0` is the same as `last tty0`. ### Examples Display information about users who failed to log in: # lastb ... zgg ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00) zgg ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00) zf ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00) za ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00) zeng ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00) zf ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00) zette ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00) z310 ssh:notty 143.198.176.57 Thu Apr 7 11:27 - 11:27 (00:00) btmp begins Fri Apr 1 07:38:45 2022 Display 5 lines of information about users who failed to log in: # lastb -n 5 mos ssh:notty 194.31.98.204 Thu Apr 28 16:52 - 16:52 (00:00) user ssh:notty 194.31.98.204 Thu Apr 28 16:52 - 16:52 (00:00) user ssh:notty 194.31.98.204 Thu Apr 28 16:52 - 16:52 (00:00) user ssh:notty 194.31.98.204 Thu Apr 28 16:52 - 16:52 (00:00) user ssh:notty 194.31.98.204 Thu Apr 28 16:52 - 16:52 (00:00) btmp begins Fri Apr 1 07:38:45 2022 [ Linux Command Manual](#)