Produces a table of login sessions, users, terminals, and source addresses from audit records. The -l login report is the fastest way to spot unexpected logins. The sibling -au report summarizes authentication attempts and failures.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.