This should be an easy one, but I can't figure it out. I'm simply trying to display a user's last successful login before this one. I know that sshd_config has this, but you cannot dictate where in the login process this displays unless you turn it off and write it yourself and append your code to /etc/profile.
I thought I'd hit the jackpot with the lastlog command so I thought I'd use something like: -
lastlog | grep -w $USER
and then use awk to get the columns I need. Fine and dandy until I discovered that the lastlog command actually gets the most recent
successful login...which is always going to be the current one. Not very useful.
If I login on Tuesday 23rd August 2011 at 15:30 then after the rest of /etc/profile has done it's stuff, lastlog will return...the same timestamp as now. I'm looking for the previous
successful login timestamp
Can I use "last" instead? I read through the man pages but couldn't work out the switches.