Linux last Command
The Linux last command is used to display recent user login information.
When executed alone, the last command reads the file named wtmp located in the /var/log/ directory and displays all the usernames recorded in that file.
Syntax
last [options] [username...] [tty...]
Parameter Description:
options:
-R Omit the hostname column.
-a Display the host name or IP address from where the system was logged into in the last line.
-d Convert IP addresses to host names.
-f<logfile> Specify the log file.
-n<number of lines> or -<number of lines> Display the specified number of lines.
-R Do not display the hostname or IP address of the system logged into.
-x Display system shutdown, reboot, and runlevel change information.
username:
- username: Display login information for the specified user.
tty:
- tty Specify the login terminal. The tty name can be abbreviated,
last 0is the same aslast tty0.
Examples
Display two lines and omit the hostname column:
# last -R -2
root pts/0 Thu Apr 28 18:06 still logged in
root pts/0 Tue Apr 26 09:06 - 19:36 (10:30)
wtmp begins Sun Apr 3 13:11:25 2022
Display two lines and omit the host column:
~# last -R -2
root pts/0 Thu Apr 28 18:06 still logged in
root pts/0 Tue Apr 26 09:06 - 19:36 (10:30)
wtmp begins Sun Apr 3 13:11:25 2022
General display method:
# last
...
root pts/4 Thu May 13 17:25 still logged in
root pts/2 Thu May 13 17:23 - 17:25 (00:02)
root pts/1 Thu May 13 16:46 still logged in
...
Abbreviated display and specify the number of lines to display:
# last -n 5 -R
root pts/4 Thu May 13 17:25 still logged in
root pts/2 Thu May 13 17:23 - 17:25 (00:02)
root pts/1 Thu May 13 16:46 still logged in
root pts/7 Thu May 13 15:36 still logged in
root pts/9 Thu May 13 15:35 still logged in
wtmp begins Thu May 13 18:55:40 2014
Display the host IP address in the last column:
# last -n 5 -a -i
root pts/4 Thu May 13 17:25 still logged in 192.168.1.10
root pts/2 Thu May 13 17:23 - 17:25 (00:02) 192.168.1.10
root pts/1 Thu May 13 16:46 still logged in 192.168.1.10
root pts/7 Thu May 13 15:36 still logged in 192.168.1.10
root pts/9 Thu May 13 15:35 still logged in 192.168.1.10
wtmp begins Thu May 13 18:55:40 2014