Search notes:

/var/log/wtmp

/var/log/wtmp records all logins and logouts of users.
The group-owner of this file is utmp.

See also

/var/log/lastlog, /var/log/faillog, /var/log/btmp
/run
/var/log
last and lastb (part of util-linux).

Index