{ 13 comments… read them below or add one }

1 jamshid February 22, 2007 at 11:29 am

On my FC5 system instead of
last reboot | head -1
I can type
last reboot -1

Reply

2 diana October 15, 2007 at 12:57 pm

i couldn’t find out the error. please help me.

#Send list of users logged on to server via email
59 11 * * * last | grep date ‘+%a %b %d’ > /tmp/users.out ; mail -s “Users Logged Today” ephrondiana@gmail.com

when i tried to execute,
$ last |grep date ‘+%a %b %d’
i got no such file or directory error.

Reply

3 nixCraft October 15, 2007 at 1:06 pm

Should be..

59 11 * * * last | grep $(date '+%a %b %d') > /tmp/users.out ; mail -s “Users Logged"

Reply

4 diana October 15, 2007 at 1:25 pm

thanks a lot vivek.i din’t expect this much fast reply.But unfortunately when i execute,
$ last | grep $(date ‘+%a %b %d’)
i couldn’t get anything.Please help

Reply

5 nixCraft October 15, 2007 at 2:12 pm

My bad…I forgot to include double quote …

59 11 * * * last | grep "$(date '+%a %b %d')" > /tmp/users.out ; mail -s “Users Logged"

Also you may wanna try out:

last -t yyyymmddhhmmss

HTH

Reply

6 diana October 16, 2007 at 3:45 am

Thanks vivek.its working great…..

Reply

7 xera December 6, 2009 at 3:04 pm

the command “last reboot” worked for me, on my mac!

Reply

8 Ajeet August 17, 2010 at 10:12 am

Can we find who rebooted the linux box?

Reply

9 Nick March 16, 2011 at 11:48 pm

In order to track who rebooted a linux machine, I would:
- disable root logins; many users sharing root is bad
- create a list of sudoers, so only people listed there could shutdown / reboot / halt
- /var/log/messages would contain traces of who ran sudo shutdown -r now or such

Reply

10 L_kernel September 23, 2010 at 1:38 pm

Thanks a lot!
I help me!

Reply

11 Sam Hocevar March 28, 2011 at 2:34 pm

wtmp is rotated by the system, so the last solution will stop working. I believe the most reliable solution is:

date -d "`cut -f1 -d. /proc/uptime` seconds ago"

Reply

12 lavermil June 13, 2011 at 9:02 pm

The uptime idea from Sam is nice but really that just returns the uptime (same as the uptime command) in date format.

Reply

13 alexander November 17, 2011 at 8:47 pm

last | grep USERNAME | grep tty | head -n 1 |awk -F ‘ ‘ ‘{print $7}’

Reply

Leave a Comment

Tagged as: , , , , , , , , , , , , , , ,

Previous post:

Next post: