I am a new Linux and Unix system user. How can I find out last logins of users and ttys on Linux/Unix-like operating systems?
You need to use the last command to show who has recently used the server and logged in and out date/time.[donotprint]
last command details | |
---|---|
Description | Show last logged in users. |
Category | N/A |
Difficulty | Easy |
Root privileges | No |
Estimated completion time | 5m |
|
Purpose
To find out when a particular user last logged in to the Linux or Unix server.
Syntax
The basic syntax is:
last
last [userNameHere]
last [tty]
last [options] [userNameHere]
If no options provided last command displays a list of all users logged in (and out) since /var/log/wtmp file was created. You can filter out results by supplying names of users and tty’s to show only those entries matching the username/tty.
last command examples
To find out who has recently logged in and out on your server, type:
$ last
Sample outputs:
root pts/1 10.1.6.120 Tue Jan 28 05:59 still logged in root pts/0 10.1.6.120 Tue Jan 28 04:08 still logged in root pts/0 10.1.6.120 Sat Jan 25 06:33 - 08:55 (02:22) root pts/1 10.1.6.120 Thu Jan 23 14:47 - 14:51 (00:03) root pts/0 10.1.6.120 Thu Jan 23 13:02 - 14:51 (01:48) root pts/0 10.1.6.120 Tue Jan 7 12:02 - 12:38 (00:35) wtmp begins Tue Jan 7 12:02:54 2014
You can specifies a file to search other than /var/log/wtmp using -f option. For example, search /nas/server/webserver/.log/wtmp:
$ last -f /nas/server/webserver/.log/wtmp
last -f /nas/server/webserver/.log/wtmp userNameHere
List all users last logged in/out time
last command searches back through the file /var/log/wtmp file and the output may go back to several months. Just use the less command or more command as follows to display output one screen at a time:
$ last | more
last | less
List a particular user last logged in
To find out when user vivek last logged in, type:
$ last vivek
$ last vivek | less
$ last vivek | grep 'Thu Jan 23'
Sample outputs:
Hide hotnames (Linux only)
To hide the display of the hostname field pass -R option:
$ last -R
last -R vivek
Sample outputs:
root pts/1 Tue Jan 28 05:59 still logged in root pts/0 Tue Jan 28 04:08 still logged in root pts/0 Sat Jan 25 06:33 - 08:55 (02:22) root pts/1 Thu Jan 23 14:47 - 14:51 (00:03) root pts/0 Thu Jan 23 13:02 - 14:51 (01:48) root pts/0 Tue Jan 7 12:02 - 12:38 (00:35) wtmp begins Tue Jan 7 12:02:54 2014
Display complete login & logout times
By deault year is now displayed by last command. You can force last command to display full login and logout times and dates by passing -F option:
$ last -F
Sample outputs:
root pts/1 10.1.6.120 Tue Jan 28 05:59:08 2014 still logged in root pts/0 10.1.6.120 Tue Jan 28 04:08:01 2014 still logged in root pts/0 10.1.6.120 Sat Jan 25 06:33:11 2014 - Sat Jan 25 08:55:11 2014 (02:22) root pts/1 10.1.6.120 Thu Jan 23 14:47:42 2014 - Thu Jan 23 14:51:31 2014 (00:03) root pts/0 10.1.6.120 Thu Jan 23 13:02:51 2014 - Thu Jan 23 14:51:27 2014 (01:48) root pts/0 10.1.6.120 Tue Jan 7 12:02:54 2014 - Tue Jan 7 12:38:03 2014 (00:35) wtmp begins Tue Jan 7 12:02:54 2014
Display full user/domain names
$ last -w
Display last reboot time
The user reboot logs in each time the system is rebooted. Thus following command will show a log of all reboots since the log file was created:
$ last reboot
$ last -x reboot
Sample outputs:
reboot system boot 2.6.32-431.3.1.e Sun Jan 5 09:33 - 06:20 (22+20:46) reboot system boot 2.6.32-431.1.2.e Sat Dec 14 12:00 - 09:30 (21+21:29) reboot system boot 2.6.32-431.el6.x Sat Nov 23 03:08 - 11:57 (21+08:48) .... .. ... reboot system boot 2.6.32-220.2.1.e Mon Jan 23 17:48 - 17:50 (00:02) reboot system boot 2.6.32-131.0.15. Mon Jan 23 17:37 - 17:44 (00:07) wtmp begins Mon Jan 23 17:37:02 2012
Display last shutdown time
Find out the system shutdown entries and run level changes:
$ last -x
$ last -x shutdown
Sample outputs:
shutdown system down 2.6.32-431.1.2.e Sun Jan 5 09:30 - 09:33 (00:03) shutdown system down 2.6.32-431.el6.x Sat Dec 14 11:57 - 12:00 (00:03) .... .. .. shutdown system down 2.6.32-220.2.1.e Mon Jan 23 17:50 - 17:53 (00:03) shutdown system down 2.6.32-131.0.15. Mon Jan 23 17:45 - 17:48 (00:03)
Find out who was logged in at a particular time
The syntax is as follows to see the state of logins as of the specified time:
$ last -t YYYYMMDDHHMMSS
$ last -t YYYYMMDDHHMMSS userNameHere
Related media
This tutorial is also available in a quick video format:
See also
- /var/log/wtmp file.
- last(1) Linux/Unix command man page
🐧 6 comments so far... add one ↓
Category | List of Unix and Linux commands |
---|---|
File Management | cat |
Firewall | Alpine Awall • CentOS 8 • OpenSUSE • RHEL 8 • Ubuntu 16.04 • Ubuntu 18.04 • Ubuntu 20.04 |
Network Utilities | dig • host • ip • nmap |
OpenVPN | CentOS 7 • CentOS 8 • Debian 10 • Debian 8/9 • Ubuntu 18.04 • Ubuntu 20.04 |
Package Manager | apk • apt |
Processes Management | bg • chroot • cron • disown • fg • jobs • killall • kill • pidof • pstree • pwdx • time |
Searching | grep • whereis • which |
User Information | groups • id • lastcomm • last • lid/libuser-lid • logname • members • users • whoami • who • w |
WireGuard VPN | Alpine • CentOS 8 • Debian 10 • Firewall • Ubuntu 20.04 |
who was logged in at a particular time
who was logged in at a particular time is not working.
rather than all are very simple greate command
Unfortunately the ‘last’ command is not always accurate, listing multiple ‘still running’ records:
boot 2016-09-27T07:32:33+1000 still running
boot 2016-09-26T18:17:55+1000 still running
boot 2016-09-25T14:09:07+1000 still running
boot 2016-09-25T10:24:46+1000 – 2016-09-25T14:08:20+1000 (03:43)
boot 2016-09-25T08:40:03+1000 – 2016-09-25T10:24:08+1000 (01:44)
Then what mean:
user tty7 :0 Mon Oct 3 18:24 – down (04:52)
user tty7 :0 Mon Oct 3 15:21 – 18:24 (03:02)
reboot system boot 4.4.0-38-generic Mon Oct 3 15:19 – 23:16 (07:56)
I wasn’t in my home before 18:30 or 18:20 (I don’t remember exactly the time that I had arrived).
And…
reboot system boot 4.4.0-21-generic Tue Oct 4 23:14 still running
user tty7 :0 Tue Oct 4 19:06 – crash (04:08)
Today is October 5th, then why my computer is “still running” if I had shutdown it yesterday and when I arrived today it was shutdown?
Can anyone help me understand this?
What is difference between “last” & “who”?
The who command show who is logged on right now. last command show a listing of last logged in and logged out users since /var/log/wtmp was created.