Linux / Unix: last Command Examples

I am a new Linux and Unix system user. How can I find out last logins of users and ttys on Linux/Unix-like operating systems?

You need to use the last command to show who has recently used the server and logged in and out date/time.[donotprint]

[/donotprint] The last command reads listing of last logged in users from the system file called /var/log/wtmp or the file designated by the -f options.

Purpose

To find out when a particular user last logged in to the Linux or Unix server.

Syntax

The basic syntax is:

last
last [userNameHere] last [tty] last [options] [userNameHere]

If no options provided last command displays a list of all users logged in (and out) since /var/log/wtmp file was created. You can filter out results by supplying names of users and tty’s to show only those entries matching the username/tty.

last command examples

To find out who has recently logged in and out on your server, type:
$ last
Sample outputs:

root     pts/1        10.1.6.120       Tue Jan 28 05:59   still logged in   
root     pts/0        10.1.6.120       Tue Jan 28 04:08   still logged in   
root     pts/0        10.1.6.120       Sat Jan 25 06:33 - 08:55  (02:22)    
root     pts/1        10.1.6.120       Thu Jan 23 14:47 - 14:51  (00:03)    
root     pts/0        10.1.6.120       Thu Jan 23 13:02 - 14:51  (01:48)    
root     pts/0        10.1.6.120       Tue Jan  7 12:02 - 12:38  (00:35)    
 
wtmp begins Tue Jan  7 12:02:54 2014

You can specifies a file to search other than /var/log/wtmp using -f option. For example, search /nas/server/webserver/.log/wtmp:
$ last -f /nas/server/webserver/.log/wtmp
last -f /nas/server/webserver/.log/wtmp userNameHere

List all users last logged in/out time

last command searches back through the file /var/log/wtmp file and the output may go back to several months. Just use the less command or more command as follows to display output one screen at a time:
$ last | more
last | less

List a particular user last logged in

To find out when user vivek last logged in, type:
$ last vivek
$ last vivek | less
$ last vivek | grep 'Thu Jan 23'

Sample outputs:

Fig. 01 Displaying out when user vivek last logged in on server

Hide hotnames (Linux only)

To hide the display of the hostname field pass -R option:
$ last -R
last -R vivek

Sample outputs:

root     pts/1        Tue Jan 28 05:59   still logged in   
root     pts/0        Tue Jan 28 04:08   still logged in   
root     pts/0        Sat Jan 25 06:33 - 08:55  (02:22)    
root     pts/1        Thu Jan 23 14:47 - 14:51  (00:03)    
root     pts/0        Thu Jan 23 13:02 - 14:51  (01:48)    
root     pts/0        Tue Jan  7 12:02 - 12:38  (00:35)    
 
wtmp begins Tue Jan  7 12:02:54 2014

Display complete login & logout times

By deault year is now displayed by last command. You can force last command to display full login and logout times and dates by passing -F option:
$ last -F
Sample outputs:

root     pts/1        10.1.6.120       Tue Jan 28 05:59:08 2014   still logged in                      
root     pts/0        10.1.6.120       Tue Jan 28 04:08:01 2014   still logged in                      
root     pts/0        10.1.6.120       Sat Jan 25 06:33:11 2014 - Sat Jan 25 08:55:11 2014  (02:22)    
root     pts/1        10.1.6.120       Thu Jan 23 14:47:42 2014 - Thu Jan 23 14:51:31 2014  (00:03)    
root     pts/0        10.1.6.120       Thu Jan 23 13:02:51 2014 - Thu Jan 23 14:51:27 2014  (01:48)    
root     pts/0        10.1.6.120       Tue Jan  7 12:02:54 2014 - Tue Jan  7 12:38:03 2014  (00:35)    
 
wtmp begins Tue Jan  7 12:02:54 2014

Display full user/domain names

$ last -w

Display last reboot time

The user reboot logs in each time the system is rebooted. Thus following command will show a log of all reboots since the log file was created:
$ last reboot
$ last -x reboot

Sample outputs:

reboot   system boot  2.6.32-431.3.1.e Sun Jan  5 09:33 - 06:20 (22+20:46)  
reboot   system boot  2.6.32-431.1.2.e Sat Dec 14 12:00 - 09:30 (21+21:29)  
reboot   system boot  2.6.32-431.el6.x Sat Nov 23 03:08 - 11:57 (21+08:48)  
....
..
...
reboot   system boot  2.6.32-220.2.1.e Mon Jan 23 17:48 - 17:50  (00:02)    
reboot   system boot  2.6.32-131.0.15. Mon Jan 23 17:37 - 17:44  (00:07)    

wtmp begins Mon Jan 23 17:37:02 2012

Display last shutdown time

Find out the system shutdown entries and run level changes:
$ last -x
$ last -x shutdown

Sample outputs:

shutdown system down  2.6.32-431.1.2.e Sun Jan  5 09:30 - 09:33  (00:03)    
shutdown system down  2.6.32-431.el6.x Sat Dec 14 11:57 - 12:00  (00:03)    
....
..
..
shutdown system down  2.6.32-220.2.1.e Mon Jan 23 17:50 - 17:53  (00:03)    
shutdown system down  2.6.32-131.0.15. Mon Jan 23 17:45 - 17:48  (00:03)    

Find out who was logged in at a particular time

The syntax is as follows to see the state of logins as of the specified time:
$ last -t YYYYMMDDHHMMSS
$ last -t YYYYMMDDHHMMSS userNameHere

Related media

This tutorial is also available in a quick video format:

See also
  • /var/log/wtmp file.
  • last(1) Linux/Unix command man page
🐧 If you liked this page, please support my work on Patreon or with a donation.
🐧 Get the latest tutorials on SysAdmin, Linux/Unix, Open Source/DevOps topics:
CategoryList of Unix and Linux commands
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
6 comments… add one
  • smita Aug 4, 2016 @ 5:13

    who was logged in at a particular time

  • smita Aug 4, 2016 @ 5:14

    who was logged in at a particular time is not working.
    rather than all are very simple greate command

  • Somebody Else Sep 26, 2016 @ 21:59

    Unfortunately the ‘last’ command is not always accurate, listing multiple ‘still running’ records:
    boot 2016-09-27T07:32:33+1000 still running
    boot 2016-09-26T18:17:55+1000 still running
    boot 2016-09-25T14:09:07+1000 still running
    boot 2016-09-25T10:24:46+1000 – 2016-09-25T14:08:20+1000 (03:43)
    boot 2016-09-25T08:40:03+1000 – 2016-09-25T10:24:08+1000 (01:44)

  • Leonardo Oct 5, 2016 @ 22:46

    Then what mean:

    user tty7 :0 Mon Oct 3 18:24 – down (04:52)
    user tty7 :0 Mon Oct 3 15:21 – 18:24 (03:02)
    reboot system boot 4.4.0-38-generic Mon Oct 3 15:19 – 23:16 (07:56)

    I wasn’t in my home before 18:30 or 18:20 (I don’t remember exactly the time that I had arrived).

    And…

    reboot system boot 4.4.0-21-generic Tue Oct 4 23:14 still running
    user tty7 :0 Tue Oct 4 19:06 – crash (04:08)

    Today is October 5th, then why my computer is “still running” if I had shutdown it yesterday and when I arrived today it was shutdown?

    Can anyone help me understand this?

  • satosh Jun 19, 2017 @ 16:43

    What is difference between “last” & “who”?

    • 🐧 Vivek Gite Jun 19, 2017 @ 17:00

      The who command show who is logged on right now. last command show a listing of last logged in and logged out users since /var/log/wtmp was created.

Leave a Reply

Your email address will not be published. Required fields are marked *

Use HTML <pre>...</pre>, <code>...</code> and <kbd>...</kbd> for code samples.