How to see historical root logins to a server Command: last -F | grep root journalctl _COMM=sshd | grep root Read More