Linux / Unix last Command Examples

last command

I am a new Linux and Unix system user. How can I find out last logins of users and ttys on Linux/Unix-like operating systems?

You need to use the last command to show who has recently used the server and logged in and out date/time. This page explains last command examples for Linux and Unix developers.

Advertisement

Purpose

To find out when a particular user last logged in to the Linux or Unix server.

Unix and Linux sysadmin is responsible for managing a multi-user server system. Often, they need to find out details about user login. Hence, we use the last command. Please note that the last command reads listing of last logged in users from the system file called /var/log/wtmp or the file designated by the -f options.

Syntax

The basic syntax is:

last
last [userNameHere]
last [tty]
last [options] [userNameHere]

If no options provided last command displays a list of all users logged in (and out) since /var/log/wtmp file was created. You can filter out results by supplying names of users and tty’s to show only those entries matching the username or tty.

Linux last command examples

To find out who has recently logged in and out on your server, type:
$ last
Here is what I see:

root     pts/1        10.1.6.120       Tue Jan 28 05:59   still logged in   
root     pts/0        10.1.6.120       Tue Jan 28 04:08   still logged in   
root     pts/0        10.1.6.120       Sat Jan 25 06:33 - 08:55  (02:22)    
root     pts/1        10.1.6.120       Thu Jan 23 14:47 - 14:51  (00:03)    
root     pts/0        10.1.6.120       Thu Jan 23 13:02 - 14:51  (01:48)    
root     pts/0        10.1.6.120       Tue Jan  7 12:02 - 12:38  (00:35)    
 
wtmp begins Tue Jan  7 12:02:54 2014

Understanding the last command outputs

Let us consider the following output line:

root     pts/0        10.1.6.120       Tue Jan 28 04:08   still logged in
  1. root – It is the user name. For example, for system events such as reboot and shutdown of the Linux/Unix box, unique user names reboot and shutdown are used to indicate that activity.
  2. pts/0 – Explains how the user logged into the system. For instance, pts for pseudoterminal session (ssh login), tty for the terminal, :0, :1, (:2) X windows GUI system, etc.
  3. 10.1.6.120 – The IP address or the FQDN (or hostname) from which the user logged into the system.
  4. Tue Jan 28 04:08 – The date and time stamp for the user login activity (the log in time).
  5. still logged in – The logout time.

Of course, you can specifies a file to search other than /var/log/wtmp using -f option. For example, search /nas/server/webserver/.log/wtmp:
$ last -f /nas/server/webserver/.log/wtmp
$ last -f /nas/server/webserver/.log/wtmp userNameHere

Linux last command examples and syntax

last command in Linux with example outputs

Pass the -n to limit the number of lines to show on the screen. For example, only display 10 lines, run:
$ last -n 10
$ last -n 10 reboot

Last 10 reboots times for AWS server:

reboot   system boot  5.13.0-1019-aws  Wed Mar 23 07:50   still running
reboot   system boot  5.13.0-1017-aws  Wed Mar 16 21:49 - 07:50 (6+10:00)
reboot   system boot  5.13.0-1017-aws  Fri Mar 11 09:55 - 21:49 (5+11:53)
reboot   system boot  5.13.0-1014-aws  Sat Mar  5 09:07 - 09:54 (6+00:47)
reboot   system boot  5.11.0-1028-aws  Wed Feb  2 08:11 - 09:07 (31+00:55)
reboot   system boot  5.11.0-1027-aws  Thu Jan 20 04:22 - 08:11 (13+03:48)
reboot   system boot  5.11.0-1025-aws  Tue Jan 11 11:03 - 04:21 (8+17:18)
reboot   system boot  5.11.0-1022-aws  Tue Dec 14 22:08 - 11:02 (27+12:53)
reboot   system boot  5.11.0-1022-aws  Tue Nov 30 19:29 - 22:08 (14+02:38)
reboot   system boot  5.11.0-1021-aws  Thu Nov 18 10:57 - 19:28 (12+08:30)
 
wtmp begins Sun Jun 27 20:53:20 2021

List all users last logged in/out time

last command searches back through the file /var/log/wtmp file and the output may go back to several months. Just use the less command or more command as follows to display output one screen at a time:
$ last | more
$ last | less

How to list a particular user last logged in

To find out when user vivek last logged in, type:
$ last vivek
$ last vivek | less
$ last vivek | grep 'Thu Jan 23'

Fig. 01 Displaying out when user vivek last logged in on server

Fig. 01 Displaying out when user vivek last logged in on server

Hide hotnames when using the last command

To hide the display of the hostname field pass -R option:
$ last -R
$ last -R vivek

Sample outputs:

root     pts/1        Tue Jan 28 05:59   still logged in   
root     pts/0        Tue Jan 28 04:08   still logged in   
root     pts/0        Sat Jan 25 06:33 - 08:55  (02:22)    
root     pts/1        Thu Jan 23 14:47 - 14:51  (00:03)    
root     pts/0        Thu Jan 23 13:02 - 14:51  (01:48)    
root     pts/0        Tue Jan  7 12:02 - 12:38  (00:35)    
 
wtmp begins Tue Jan  7 12:02:54 2014

Show complete login and logout times

By default, year is now displayed by last command. You can force last command to display full login and logout times and dates by passing -F option. For instance:
$ last -F
Here is what we see:

root     pts/1        10.1.6.120       Tue Jan 28 05:59:08 2014   still logged in                      
root     pts/0        10.1.6.120       Tue Jan 28 04:08:01 2014   still logged in                      
root     pts/0        10.1.6.120       Sat Jan 25 06:33:11 2014 - Sat Jan 25 08:55:11 2014  (02:22)    
root     pts/1        10.1.6.120       Thu Jan 23 14:47:42 2014 - Thu Jan 23 14:51:31 2014  (00:03)    
root     pts/0        10.1.6.120       Thu Jan 23 13:02:51 2014 - Thu Jan 23 14:51:27 2014  (01:48)    
root     pts/0        10.1.6.120       Tue Jan  7 12:02:54 2014 - Tue Jan  7 12:38:03 2014  (00:35)    
 
wtmp begins Tue Jan  7 12:02:54 2014

Display full user/domain names

$ last -w

Display last reboot time

The user reboot logs in each time the system is rebooted. Thus following command will show a log of all reboots since the log file was created:
$ last reboot
$ last -x reboot

Sample outputs:

reboot   system boot  2.6.32-431.3.1.e Sun Jan  5 09:33 - 06:20 (22+20:46)  
reboot   system boot  2.6.32-431.1.2.e Sat Dec 14 12:00 - 09:30 (21+21:29)  
reboot   system boot  2.6.32-431.el6.x Sat Nov 23 03:08 - 11:57 (21+08:48)  
....
..
...
reboot   system boot  2.6.32-220.2.1.e Mon Jan 23 17:48 - 17:50  (00:02)    
reboot   system boot  2.6.32-131.0.15. Mon Jan 23 17:37 - 17:44  (00:07)    

wtmp begins Mon Jan 23 17:37:02 2012

Display last shutdown time

Find out the system shutdown entries and run level changes:
$ last -x
$ last -x shutdown

Sample outputs:

shutdown system down  2.6.32-431.1.2.e Sun Jan  5 09:30 - 09:33  (00:03)    
shutdown system down  2.6.32-431.el6.x Sat Dec 14 11:57 - 12:00  (00:03)    
....
..
..
shutdown system down  2.6.32-220.2.1.e Mon Jan 23 17:50 - 17:53  (00:03)    
shutdown system down  2.6.32-131.0.15. Mon Jan 23 17:45 - 17:48  (00:03)    

Find out who was logged in at a particular time

The syntax is as follows to see the state of logins as of the specified time:
$ last -t YYYYMMDDHHMMSS
$ last -t YYYYMMDDHHMMSS userNameHere

In other words you can display the lines until the specified time formats:

       YYYYMMDDhhmmss
       YYYY-MM-DD hh:mm:ss
       YYYY-MM-DD hh:mm     (seconds will be set to 00)
       YYYY-MM-DD           (time will be set to 00:00:00)
       hh:mm:ss             (date will be set to today)
       hh:mm                (date will be set to today, seconds to 00)
       now
       yesterday            (time is set to 00:00:00)
       today                (time is set to 00:00:00)
       tomorrow             (time is set to 00:00:00)
       +5min
       -5days

Hence, we can use the following syntax:
$ last -t now
$ last -t +5min vivek
# see last three days login activity on linux for 'vivek' user #
$ last -t -3days vivek

See bad login attempts

Use the lastb command as follows:
# lastb

[sudo] password for vivek: 
root     ssh:notty    192.168.2.17     Sat Apr  2 00:00 - 00:00  (00:00)
root     ssh:notty    192.168.2.17     Sat Apr  2 00:00 - 00:00  (00:00)
root     ssh:notty    192.168.2.17     Fri Apr  1 00:00 - 00:00  (00:00)
root     ssh:notty    192.168.2.17     Fri Apr  1 00:00 - 00:00  (00:00)
 
btmp begins Fri Apr  1 00:00:45 2022

Related media

This tutorial is also available in a quick video format:

Summing up

You learned about the last command under Linux and Unix-like system. Do read the following manual pages using the man command or help command:
$ man 1 last
$ man 5 wtmp

🥺 Was this helpful? Please add a comment to show your appreciation or feedback.

nixCrat Tux Pixel Penguin
Hi! 🤠
I'm Vivek Gite, and I write about Linux, macOS, Unix, IT, programming, infosec, and open source. Subscribe to my RSS feed or email newsletter for updates.

6 comments… add one
  • smita Aug 4, 2016 @ 5:13

    who was logged in at a particular time

  • smita Aug 4, 2016 @ 5:14

    who was logged in at a particular time is not working.
    rather than all are very simple greate command

  • Somebody Else Sep 26, 2016 @ 21:59

    Unfortunately the ‘last’ command is not always accurate, listing multiple ‘still running’ records:
    boot 2016-09-27T07:32:33+1000 still running
    boot 2016-09-26T18:17:55+1000 still running
    boot 2016-09-25T14:09:07+1000 still running
    boot 2016-09-25T10:24:46+1000 – 2016-09-25T14:08:20+1000 (03:43)
    boot 2016-09-25T08:40:03+1000 – 2016-09-25T10:24:08+1000 (01:44)

  • Leonardo Oct 5, 2016 @ 22:46

    Then what mean:

    user tty7 :0 Mon Oct 3 18:24 – down (04:52)
    user tty7 :0 Mon Oct 3 15:21 – 18:24 (03:02)
    reboot system boot 4.4.0-38-generic Mon Oct 3 15:19 – 23:16 (07:56)

    I wasn’t in my home before 18:30 or 18:20 (I don’t remember exactly the time that I had arrived).

    And…

    reboot system boot 4.4.0-21-generic Tue Oct 4 23:14 still running
    user tty7 :0 Tue Oct 4 19:06 – crash (04:08)

    Today is October 5th, then why my computer is “still running” if I had shutdown it yesterday and when I arrived today it was shutdown?

    Can anyone help me understand this?

  • satosh Jun 19, 2017 @ 16:43

    What is difference between “last” & “who”?

    • 🛡️ Vivek Gite (Author and Admin) Vivek Gite Jun 19, 2017 @ 17:00

      The who command show who is logged on right now. last command show a listing of last logged in and logged out users since /var/log/wtmp was created.

Leave a Reply

Your email address will not be published. Required fields are marked *

Use HTML <pre>...</pre> for code samples. Your comment will appear only after approval by the site admin.