Whether you're investigating suspicious activity or you're just curious about past logins, it's good to know where to look to find your login history. There are three separate files that contain user login information for your server:
/var/log/wtmp - contains logs of login and logout attempts
/var/run/utmp - contains logs of current logins
/var/log/btmp - contains logs of bad login attempts
This article from Linux Handbook has more in depth descriptions of these:
As mentioned in this other Community post, you can access any of these logs using your favorite text editor (nano, vi, etc.), but since they allow you to edit the file, it's generally a better idea to use the
last) commands to display the logs as output and navigate page by page.
An example of how to do this might be:
cat /var/log/utmp | less
How to navigate with
less: Unix Less Command: 10 Tips for Effective Navigation
Or if you're using
last: Linux last Command Tutorial
*Something to keep in mind is that you will need to be logged in as a user with the proper permissions to read and access log files.
Hope this helps - happy log reading!