Linux / Unix: last Command Examples

by on January 27, 2013 · 0 comments· LAST UPDATED January 28, 2014

in , ,

last command

I am a new Linux and Unix system user. How can I find out last logins of users and ttys on Linux/Unix-like operating systems?

You need to use the last command to show who has recently used the server and logged in and out date/time.

The last command reads listing of last logged in users from the system file called /var/log/wtmp or the file designated by the -f options.

Purpose

To find out when a particular user last logged in to the Linux or Unix server.

Syntax

The basic syntax is:

last
last [userNameHere]
last [tty]
last [options] [userNameHere]

If no options provided last command displays a list of all users logged in (and out) since /var/log/wtmp file was created. You can filter out results by supplying names of users and tty’s to show only those entries matching the username/tty.

last command examples

To find out who has recently logged in and out on your server, type:
$ last
Sample outputs:

oot     pts/1        10.1.6.120       Tue Jan 28 05:59   still logged in
root     pts/0        10.1.6.120       Tue Jan 28 04:08   still logged in
root     pts/0        10.1.6.120       Sat Jan 25 06:33 - 08:55  (02:22)
root     pts/1        10.1.6.120       Thu Jan 23 14:47 - 14:51  (00:03)
root     pts/0        10.1.6.120       Thu Jan 23 13:02 - 14:51  (01:48)
root     pts/0        10.1.6.120       Tue Jan  7 12:02 - 12:38  (00:35)
 
wtmp begins Tue Jan  7 12:02:54 2014
 

You can specifies a file to search other than /var/log/wtmp using -f option. For example, search /nas/server/webserver/.log/wtmp:
$ last -f /nas/server/webserver/.log/wtmp
last -f /nas/server/webserver/.log/wtmp userNameHere

List all users last logged in/out time

last command searches back through the file /var/log/wtmp file and the output may go back to several months. Just use the less command or more command as follows to display output one screen at a time:
$ last | more
last | less

List a particular user last logged in

To find out when user vivek last logged in, type:
$ last vivek
$ last vivek | less
$ last vivek | grep 'Thu Jan 23'

Sample outputs:

Fig. 01 Displaying out when user vivek last logged in on server

Fig. 01 Displaying out when user vivek last logged in on server

Hide hotnames (Linux only)

To hide the display of the hostname field pass -R option:
$ last -R
last -R vivek

Sample outputs:

oot     pts/1        Tue Jan 28 05:59   still logged in
root     pts/0        Tue Jan 28 04:08   still logged in
root     pts/0        Sat Jan 25 06:33 - 08:55  (02:22)
root     pts/1        Thu Jan 23 14:47 - 14:51  (00:03)
root     pts/0        Thu Jan 23 13:02 - 14:51  (01:48)
root     pts/0        Tue Jan  7 12:02 - 12:38  (00:35)
 
wtmp begins Tue Jan  7 12:02:54 2014

Display complete login & logout times

By deault year is now displayed by last command. You can force last command to display full login and logout times and dates by passing -F option:
$ last -F
Sample outputs:

oot     pts/1        10.1.6.120       Tue Jan 28 05:59:08 2014   still logged in
root     pts/0        10.1.6.120       Tue Jan 28 04:08:01 2014   still logged in
root     pts/0        10.1.6.120       Sat Jan 25 06:33:11 2014 - Sat Jan 25 08:55:11 2014  (02:22)
root     pts/1        10.1.6.120       Thu Jan 23 14:47:42 2014 - Thu Jan 23 14:51:31 2014  (00:03)
root     pts/0        10.1.6.120       Thu Jan 23 13:02:51 2014 - Thu Jan 23 14:51:27 2014  (01:48)
root     pts/0        10.1.6.120       Tue Jan  7 12:02:54 2014 - Tue Jan  7 12:38:03 2014  (00:35)
 
wtmp begins Tue Jan  7 12:02:54 2014
 

Display full user/domain names

$ last -w

Display last reboot time

The user reboot logs in each time the system is rebooted. Thus following command will show a log of all reboots since the log file was created:
$ last reboot
$ last -x reboot

Sample outputs:

reboot   system boot  2.6.32-431.3.1.e Sun Jan  5 09:33 - 06:20 (22+20:46)
reboot   system boot  2.6.32-431.1.2.e Sat Dec 14 12:00 - 09:30 (21+21:29)
reboot   system boot  2.6.32-431.el6.x Sat Nov 23 03:08 - 11:57 (21+08:48)
....
..
...
reboot   system boot  2.6.32-220.2.1.e Mon Jan 23 17:48 - 17:50  (00:02)
reboot   system boot  2.6.32-131.0.15. Mon Jan 23 17:37 - 17:44  (00:07)
wtmp begins Mon Jan 23 17:37:02 2012

Display last shutdown time

Find out the system shutdown entries and run level changes:
$ last -x
$ last -x shutdown

Sample outputs:

shutdown system down  2.6.32-431.1.2.e Sun Jan  5 09:30 - 09:33  (00:03)
shutdown system down  2.6.32-431.el6.x Sat Dec 14 11:57 - 12:00  (00:03)
....
..
..
shutdown system down  2.6.32-220.2.1.e Mon Jan 23 17:50 - 17:53  (00:03)
shutdown system down  2.6.32-131.0.15. Mon Jan 23 17:45 - 17:48  (00:03)

Find out who was logged in at a particular time

The syntax is as follows to see the state of logins as of the specified time:
$ last -t YYYYMMDDHHMMSS
$ last -t YYYYMMDDHHMMSS userNameHere

Related media

This tutorial is also available in a quick video format:

See also
CategoryList of Unix and Linux commands
File Managementcat
Network Utilitiesdighostip
Processes Managementbgchrootdisownfgjobskillkillallpwdxtimepidofpstree
Searchingwhereiswhich
User Informationgroupsidlastlastcommlognameuserswwhowhoamilidmembers

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 0 comments… add one now }

Leave a Comment

Tagged as: ,

Previous Faq:

Next Faq: