A tutorial on using the last command in Linux Terminal

If you’re managing a multi-user system, you need to know who, when, and where users logged into the machine.

last It is a command line utility that displays information about the last login session of a system user. This is especially useful when you need to track user activity or investigate possible system violations.

This article describes how to check who is logged into the system using commands last.

How to use commands last

Syntax for commands last As follows:

last [OPTIONS] [USER] [...]

Every time a user logs in to the system, the logs for that login session are written to a file /var/log/wtmp. ranking last It reads the wtmp file and prints the user’s login and logout information. Notes are printed in reverse chronological order, starting with the most recent.

Moment last Called without any options or arguments, the result will look like this:

rudi     pts/0        10.10.0.7   Fri Feb 21 21:23   still logged in
rudi     pts/0        10.10.0.7   Tue Feb 18 22:34 - 00:05  (01:31)
lisa     :0           :0          Thu Feb 13 09:19   gone - no logout
reboot   system boot  4.15.0-74-g Fri Jan 24 08:03 - 08:03  (00:00)
...

Each line of output contains the following columns from left to right:

• Username. When the system restarts or shuts down, last appear to the user reboot And the shutdown.
• tty The venue of the session. :0 Means that the user is logged into the desktop environment.
• The IP address or hostname where the user is logged on.
• The session starts and stops.
• session duration. If the session is still active or the user is not logged out, last It will display information about the session, not the duration of the session.

To limit the output to a specific user or tty, pass the username or tty as an argument to the command last:

last rudilast pts/0

You can also specify multiple usernames and as arguments:

last rudi root pts/0

command options last

last Receive several options that allow you to select, format and filter the output. In this section, we will cover the most common of them.

To specify the number of lines to print on the command line, provide a number starting with a hyphen for the command last. For example, to print only the last ten login sessions, you would type:

last -10

with options -p (--present), you can see who logged into the system on a particular date.

last -p 2020-01-15

Use options -s (--since) And the -t (--until) to tell the command last Displays rows since or until the specified time. These two options are often used together to specify the time interval for which you want to retrieve information. For example to display the login logs from Feb 13th to Feb 18th you could run:

last -s 2020-02-13 -u 2020-02-18

for options -pAnd the -s And the -t It can be specified in the following format:

YYYYMMDDhhmmss
YYYY-MM-DD hh:mm:ss
YYYY-MM-DD hh:mm     (seconds will be set to 00)
YYYY-MM-DD           (time will be set to 00:00:00)
hh:mm:ss             (date will be set to today)
hh:mm                (date will be set to today, seconds to 00)
now
yesterday            (time is set to 00:00:00)
today                (time is set to 00:00:00)
tomorrow             (time is set to 00:00:00)
+5min
-5days

By default, last Seconds and year are not shown. Use options -FAnd the --fulltimes To view the full incoming and outgoing times and dates:

last -F

Cucumber -i (--ip) force last to always display the IP address, and -d (--dns) to display the host name

last -i

conclusion

ranking last Prints information about the user’s logon and logout time. For more information on this matter, write man last at your station.