18.08.2011 - If present /var/log/secure also contains an access log. Besides the login from the ssh daemon the command last also shows (failed) logins .