If you’re managing a multi-user system, you need to know who, when, and where users logged into the machine.
last It is a command line utility that displays information about the last login session of a system user. This is especially useful when you need to track user activity or investigate possible system violations.
This article describes how to check who is logged into the system using commands
How to use commands
Syntax for commands
last As follows:
last [OPTIONS] [USER] [...]
Every time a user logs in to the system, the logs for that login session are written to a file
last It reads the wtmp file and prints the user’s login and logout information. Notes are printed in reverse chronological order, starting with the most recent.
last Called without any options or arguments, the result will look like this:
rudi pts/0 10.10.0.7 Fri Feb 21 21:23 still logged in rudi pts/0 10.10.0.7 Tue Feb 18 22:34 - 00:05 (01:31) lisa :0 :0 Thu Feb 13 09:19 gone - no logout reboot system boot 4.15.0-74-g Fri Jan 24 08:03 - 08:03 (00:00) ...
Each line of output contains the following columns from left to right:
- Username. When the system restarts or shuts down,
lastappear to the user
ttyThe venue of the session.
:0Means that the user is logged into the desktop environment.
- The IP address or hostname where the user is logged on.
- The session starts and stops.
- session duration. If the session is still active or the user is not logged out,
lastIt will display information about the session, not the duration of the session.
To limit the output to a specific user or tty, pass the username or tty as an argument to the command
You can also specify multiple usernames and as arguments:
last rudi root pts/0
last Receive several options that allow you to select, format and filter the output. In this section, we will cover the most common of them.
To specify the number of lines to print on the command line, provide a number starting with a hyphen for the command
last. For example, to print only the last ten login sessions, you would type:
--present), you can see who logged into the system on a particular date.
last -p 2020-01-15
--since) And the
--until) to tell the command
last Displays rows since or until the specified time. These two options are often used together to specify the time interval for which you want to retrieve information. For example to display the login logs from Feb 13th to Feb 18th you could run:
last -s 2020-02-13 -u 2020-02-18
-s And the
-t It can be specified in the following format:
YYYYMMDDhhmmss YYYY-MM-DD hh:mm:ss YYYY-MM-DD hh:mm (seconds will be set to 00) YYYY-MM-DD (time will be set to 00:00:00) hh:mm:ss (date will be set to today) hh:mm (date will be set to today, seconds to 00) now yesterday (time is set to 00:00:00) today (time is set to 00:00:00) tomorrow (time is set to 00:00:00) +5min -5days
last Seconds and year are not shown. Use options
--fulltimes To view the full incoming and outgoing times and dates:
last to always display the IP address, and
--dns) to display the host name
last Prints information about the user’s logon and logout time. For more information on this matter, write
man last at your station.