HowTo: Clear or Remove Last Login History in Linux

From the following article you will learn how to clear or remove the last login information on a Linux server from the command line.

On the Linux systems there are three standard commands that show the information about last logged in users: last, lastb, and lastlog.

The output of these commands include: login-name, last login time, IP address, port etc.

Cool Tip: Clear the BASH history effectively! Read more →

And sometimes, to keep anonymity, it is required to erase last login history.

To check the last login history, including the history of login attempts that failed, run one of the commands from the table below.

Command Logfile Description
last /var/log/wtmp Lists successful login/logout history
lastb /var/log/btmp Shows the bad login attempts
lastlog /var/log/lastlog Shows the most recent login

Remove Information About Last Logins

You already how to check the last login history in Linux, so now it is time to learn how to clear it.

As you can see from the table, the information about the last logged in users, including failed attempts to login, is stored in the specific binary files that you can’t edit but can easily empty them.

To remove all the information about the last logged in users, you have to clear the files where this information is kept:

# echo > /var/log/wtmp
# echo > /var/log/btmp
# echo > /var/log/lastlog

Cool Tip: Want to stay anonymous? Learn how to use PROXY on the Linux command line. Read more →

That’s all! Hope this short article will be helpful.

4 Replies to “HowTo: Clear or Remove Last Login History in Linux”

  1. Hello,guys.Can I reprint this article?Thanks.

    1. Yes, you can with the mentioning of the source.

  2. This guide is clearly incomplete…
    check /var/log/auth.log and /var/log/syslog
    They also store foundamental information of your SSH sessions such as IP, port, user and etc..

  3. When you say “clear”, specifically how do you do that as these files come up as jibberish in a normal text eidtor? i.e. hexedit the binary files? Edit these binary files somehow in a normal editor? Delete the file? Special commands?

Leave a Reply