last / lastb

last -f /var/log/wtmp; lastb -f /var/log/btmp

Lists successful logons (wtmp with last) and failed ones (btmp with lastb) on the system, with user, terminal, and origin.

Run it when you want the access timeline for the host: last gives you successful logons with their origin and session duration, lastb gives you failed attempts. It's the first question in any Linux IR — 'who got in and from where?'. With last -f on historical wtmp you can reconstruct weeks of access, and the pattern you're hunting is a service account logging in from an IP that isn't its own, or sessions at impossible hours. On hosts without a SIEM, it's the source of truth for local authentication.

Don't trust wtmp/btmp as definitive evidence: an attacker with root can clean them (utmpdump, truncation, or direct deletion) — the absence of entries when there should be some is already a finding. And watch out: wtmp records session logons (login, interactive SSH), not one-off executions (a cron, a service, a command via sudo without a session) — the access picture is partial. On hosts with high rotation, wtmp rotates (wtmp.1, wtmp.2...): for the full history you need to check the rotated ones too. The origin shown depends on the service logging it: SSH does, some internal services don't.