- View last logins, their duration and other information as read from /var/log/wtmp:last- Specify how many of the last logins to show:last -n [login_count]- Print the full date and time for entries and then display the hostname column last to prevent truncation:last -F -a- View all logins by a specific user and show the ip address instead of the hostname:last [user_name] -i- View all recorded reboots (i.e., the last logins of the pseudo user "reboot"):last reboot- View all recorded shutdowns (i.e., the last logins of the pseudo user "shutdown"):last shutdown
last [options] [username...] [tty...] lastb [options] [username...] [tty...]
last searches back through the /var/log/wtmp file (or the file designated by the -f option) and displays a list of all users logged in (and out) since that file was created. One or more usernames and/or ttys can be given, in which case last will show only the entries matching those arguments. Names of ttys can be abbreviated, thus last 0 is the same as last tty0.
When catching a SIGINT signal (generated by the interrupt key, usually control-C) or a SIGQUIT signal, last will show how far it has searched through the file; in the case of the SIGINT signal last will then terminate.
The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all the reboots since the log file was created.
lastb is the same as last, except that by default it shows a log of the /var/log/btmp file, which contains all the bad login attempts.
The options that take the time argument understand the following formats:
The files wtmp and btmp might not be found. The system only logs information in these files if they are present. This is a local configuration issue. If you want the files to be used, they can be created with a simple touch(1) command (for example, touch /var/log/wtmp).
Miquel van Smoorenburg
The last command is part of the util-linux package and is available from Linux Kernel Archive
shutdown(8), login(1), init(8)