Linux / Unix: last Command Examples

I am a new Linux and Unix system user. How can I find out last logins of users and ttys on Linux/Unix-like operating systems?

You need to use the last command to show who has recently used the server and logged in and out date/time.[donotprint]

Purpose

To find out when a particular user last logged in to the Linux or Unix server.

Syntax

The basic syntax is:

last
last [userNameHere] last [tty] last [options] [userNameHere]

If no options provided last command displays a list of all users logged in (and out) since /var/log/wtmp file was created. You can filter out results by supplying names of users and tty’s to show only those entries matching the username/tty.

last command examples

To find out who has recently logged in and out on your server, type:
$ last
Sample outputs:

root     pts/1        10.1.6.120       Tue Jan 28 05:59   still logged in   
root     pts/0        10.1.6.120       Tue Jan 28 04:08   still logged in   
root     pts/0        10.1.6.120       Sat Jan 25 06:33 - 08:55  (02:22)    
root     pts/1        10.1.6.120       Thu Jan 23 14:47 - 14:51  (00:03)    
root     pts/0        10.1.6.120       Thu Jan 23 13:02 - 14:51  (01:48)    
root     pts/0        10.1.6.120       Tue Jan  7 12:02 - 12:38  (00:35)    
 
wtmp begins Tue Jan  7 12:02:54 2014

You can specifies a file to search other than /var/log/wtmp using -f option. For example, search /nas/server/webserver/.log/wtmp:
$ last -f /nas/server/webserver/.log/wtmp
last -f /nas/server/webserver/.log/wtmp userNameHere

List all users last logged in/out time

last command searches back through the file /var/log/wtmp file and the output may go back to several months. Just use the less command or more command as follows to display output one screen at a time:
$ last | more
last | less

List a particular user last logged in

To find out when user vivek last logged in, type:
$ last vivek
$ last vivek | less
$ last vivek | grep 'Thu Jan 23'
Sample outputs:

Fig. 01 Displaying out when user vivek last logged in on server

Hide hotnames (Linux only)

To hide the display of the hostname field pass -R option:
$ last -R
last -R vivek
Sample outputs:

root     pts/1        Tue Jan 28 05:59   still logged in   
root     pts/0        Tue Jan 28 04:08   still logged in   
root     pts/0        Sat Jan 25 06:33 - 08:55  (02:22)    
root     pts/1        Thu Jan 23 14:47 - 14:51  (00:03)    
root     pts/0        Thu Jan 23 13:02 - 14:51  (01:48)    
root     pts/0        Tue Jan  7 12:02 - 12:38  (00:35)    
 
wtmp begins Tue Jan  7 12:02:54 2014

Display complete login & logout times

By deault year is now displayed by last command. You can force last command to display full login and logout times and dates by passing -F option:
$ last -F
Sample outputs:

root     pts/1        10.1.6.120       Tue Jan 28 05:59:08 2014   still logged in                      
root     pts/0        10.1.6.120       Tue Jan 28 04:08:01 2014   still logged in                      
root     pts/0        10.1.6.120       Sat Jan 25 06:33:11 2014 - Sat Jan 25 08:55:11 2014  (02:22)    
root     pts/1        10.1.6.120       Thu Jan 23 14:47:42 2014 - Thu Jan 23 14:51:31 2014  (00:03)    
root     pts/0        10.1.6.120       Thu Jan 23 13:02:51 2014 - Thu Jan 23 14:51:27 2014  (01:48)    
root     pts/0        10.1.6.120       Tue Jan  7 12:02:54 2014 - Tue Jan  7 12:38:03 2014  (00:35)    
 
wtmp begins Tue Jan  7 12:02:54 2014

Display full user/domain names

$ last -w

Display last reboot time

The user reboot logs in each time the system is rebooted. Thus following command will show a log of all reboots since the log file was created:
$ last reboot
$ last -x reboot
Sample outputs:

reboot   system boot  2.6.32-431.3.1.e Sun Jan  5 09:33 - 06:20 (22+20:46)  
reboot   system boot  2.6.32-431.1.2.e Sat Dec 14 12:00 - 09:30 (21+21:29)  
reboot   system boot  2.6.32-431.el6.x Sat Nov 23 03:08 - 11:57 (21+08:48)  
....
..
...
reboot   system boot  2.6.32-220.2.1.e Mon Jan 23 17:48 - 17:50  (00:02)    
reboot   system boot  2.6.32-131.0.15. Mon Jan 23 17:37 - 17:44  (00:07)    

wtmp begins Mon Jan 23 17:37:02 2012

Display last shutdown time

Find out the system shutdown entries and run level changes:
$ last -x
$ last -x shutdown
Sample outputs:

shutdown system down  2.6.32-431.1.2.e Sun Jan  5 09:30 - 09:33  (00:03)    
shutdown system down  2.6.32-431.el6.x Sat Dec 14 11:57 - 12:00  (00:03)    
....
..
..
shutdown system down  2.6.32-220.2.1.e Mon Jan 23 17:50 - 17:53  (00:03)    
shutdown system down  2.6.32-131.0.15. Mon Jan 23 17:45 - 17:48  (00:03)    

Find out who was logged in at a particular time

The syntax is as follows to see the state of logins as of the specified time:
$ last -t YYYYMMDDHHMMSS
$ last -t YYYYMMDDHHMMSS userNameHere

Related media

This tutorial is also available in a quick video format:

See also

• /var/log/wtmp file.
• last(1) Linux/Unix command man page