linux login log

from https://www.digitalocean.com/community/tutorials/how-to-monitor-system-authentication-logs-on-ubuntu

How To Use the "last" Command

Usually, you will only be interested in the most recent login attempts. You can see these with the "last" tool:

last

demoer   pts/1        rrcs-72-43-115-1 Thu Sep  5 19:37   still logged in   
root     pts/1        rrcs-72-43-115-1 Thu Sep  5 19:37 - 19:37  (00:00)    
root     pts/0        rrcs-72-43-115-1 Thu Sep  5 19:15   still logged in   
root     pts/0        rrcs-72-43-115-1 Thu Sep  5 18:35 - 18:44  (00:08)    
root     pts/0        rrcs-72-43-115-1 Thu Sep  5 18:20 - 18:20  (00:00)    
demoer   pts/0        rrcs-72-43-115-1 Thu Sep  5 18:19 - 18:19  (00:00)

How To Use the "lastlog" Command

If you would like to look at this situation from a different angle, you can view the last time each user on the system logged in.

This information is provided by accessing the "/etc/log/lastlog" file. It is then sorted according to the entries in the "/etc/passwd" file:

lastlog

Username         Port     From             Latest
root             pts/1    rrcs-72-43-115-1 Thu Sep  5 19:37:02 +0000 2013
daemon                                     **Never logged in**
bin                                        **Never logged in**
sys                                        **Never logged in**
sync                                       **Never logged in**
games                                      **Never logged in**
. . .

You can see the latest login time of every user on the system.

from https://askubuntu.com/questions/390201/how-to-see-login-history

sudo cat /var/log/auth.log | grep "session opened for user root"

or

sudo cat /var/log/auth.log | grep "session closed for user root"

It will give you extra information what you want to know about user's logged in your system without your permission :):)