Linux boot time question

Posted on 2011-02-28
Medium Priority
Last Modified: 2012-05-11
I have a pretty simple question, I need help in understanding the login process to be precise I want to know how is the lastlog printed upon login.
Question by:Peddu_bhanu
  • 2
  • 2
  • 2
  • +2
LVL 12

Expert Comment

ID: 34997571
LVL 20

Expert Comment

ID: 34997645
Linux does not do anything like this.

The GNU Linux Kernel is the heart inside linux that makes the system run.  Each distribution (each makers version of the linux system) has the commands and setup that those people design (or take from existing systems).

So where any commands like this are run and output on bootup / login are totally different depending on your distro.

If the commands run on boot look in :


If (as you are asking) it happens on login, check files like :


LVL 26

Expert Comment

ID: 35001445
lastlog normally tells you what user name has logged on from what computer or system. Normally, it would give you a fully qualified name from the computer where you access from.

Run this command:

cat /var/log/lastlog


tail /var/log/lastlog

A proven path to a career in data science

At Springboard, we know how to get you a job in data science. With Springboard’s Data Science Career Track, you’ll master data science  with a curriculum built by industry experts. You’ll work on real projects, and get 1-on-1 mentorship from a data scientist.


Expert Comment

by:Alberto Cortes
ID: 35003036
The /var/log/lastlog file is a database which contains info on the last login of each user. You should not rotate it. It is a sparse file, so its size on the disk is usually much smaller than the one shown by "ls -l". You cannot display it using "cat" or "tail".

Use next syntax:
       lastlog [options]

  -b, --before DAYS     print only lastlog records older than DAYS
  -h, --help            display this help message and exit
  -t, --time DAYS       print only lastlog records more recent than DAYS
  -u, --user LOGIN      print lastlog record for user with specified LOGIN

Author Comment

ID: 35005041
Thank you for your replies, I m still not clear that after the authentication when /etc/profile or $HOME/.bash_profile & .bashrc or /etc/bashrc is run which specific part of the code calls for last log.

I know that we may disable it with $HOME/.hushlogin or hae our own custom scripts in /etc/profile.d/.

I would like to know how/which part of the code in profile or sysconfig/functions displays lastlog upon login.

I have checked with almost the entire /etc direcotry for any pattern "lastlog" in any file.I found none.

Any ideas.

Thanks in advance
LVL 12

Accepted Solution

upanwar earned 2000 total points
ID: 35005901
I have found something for you.

The getty(1m) man-page contains a list of the different information that you can include with the login: prompt. If you are providing PPP services, I recommend that you do not cahnge anything in your login prompt, such as the date/time or the port name. This makes creating chat scripts difficult, as the users trying to login will not know what to expect.

At this point, we are left with the last login messages. Unfortunately, these are not contained in files that are as easily removed as /etc/motd and /etc/issue. However, by creating a file, the file .hushlogin in your home directory, we can remove them. It has no contents; rather, the existence of this file is the key. You can create it simply by changing to a users home directory (yours, if you are that user) and running

touch .hushlogin

Often administrators want to keep users' knowledge of the system as limited as possible. This is particularly important for systems with a high level of security in which users start applications and never see the shell prompt. One give-away to what kind of system you are on is the following line when you login:

Here is the complete article:



Author Comment

ID: 35067842
Nothing has answered my question ,though close to it.Unfortunately we o not have anything concrete which can be pointed out in terms of printing that output.
LVL 20

Expert Comment

ID: 35073099
As above... every distro is different and does things in different ways and in different places.
Give us a clue and tell us which distribution (and version) you are running.

other wise you are saying 'tell me exactly how my car operates'.
We can give you a rough idea as all cars have 4 wheels (well most do) and all have doors and windows etc but if you want detailed specifics you are going to have to give US some more info.

Featured Post

Build your data science skills into a career

Are you ready to take your data science career to the next step, or break into data science? With Springboard’s Data Science Career Track, you’ll master data science topics, have personalized career guidance, weekly calls with a data science expert, and a job guarantee.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

It’s 2016. Password authentication should be dead — or at least close to dying. But, unfortunately, it has not traversed Quagga stage yet. Using password authentication is like laundering hotel guest linens with a washboard — it’s Passé.
Virtualization software lets you run different versions of Windows, Ubuntu Linux and other versions of Linux all at the same time, rather than running each one directly from your computer's hard drive.
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
How to Install VMware Tools in Red Hat Enterprise Linux 6.4 (RHEL 6.4) Step-by-Step Tutorial
Suggested Courses

587 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question