Filters audit records for USER_LOGIN messages, the type written at each login attempt, limited to recent activity by -ts recent. Combine with aureport -l for a login summary instead of raw records. Requires the login ruleset to be loaded.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.