Linux / Unix: Check Last Time User Logged In On The System

See all GNU/Linux related FAQ
I am a new Unix system admin. How do I find ouw who has recently use the Linux or Unix-like server? Which terminals they used, and when they logged in and out of the my server?

You need to use last command to find last time user logged into the Linux or Unix system. This command displays last logins of users and ttys.
Tutorial details
Difficulty level Easy
Root privileges No
Requirements Linux or Unix terminal
Category User Information
OS compatibility AIX AlmaLinux Alpine Arch CentOS Debian Fedora FreeBSD HP-UX Linux macOS Mint NetBSD OpenBSD openSUSE Pop!_OS RHEL Rocky Stream SUSE Ubuntu Unix WSL
Est. reading time 3 minutes
Advertisement

Listing the Last times a user logged in on server

The syntax is as follows:
$ last
$ last {UserNameHere}
$ last [option] {UserNameHere}

The most straightforward way to find the last login on your Linux and Unix server is to tye the last command with no CLI options. For instance:
$ last
Linux or Unix - Check Last Time User Logged In On The System Command
Let us see some more examples.

Displaying last time user logged into a Linux or Unix system

To display when a user named ‘vivek’ last logged in to the system, type:
$ last vivek
$ last vivek | less

Fig.01: last command in action on my Debian base nas server

Fig.01: last command in action on my Debian base nas server

The output in this example tell us when user vivek last logged in. The output will go back for several months or more as last command searches back through the file /var/log/wtmp and displays a list of all users logged in (and out) since that file was created.

Display a list of recent system use for all users

Simply type the last command:
$ last
OR use the pager such as less command/more command to display one screen at a time. For example:
$ last | less
Sample outputs taken from my RHEL based server:

root     pts/0        10.1.6.120       Mon Jan 27 06:26   still logged in   
root     pts/0        10.1.6.120       Mon Jan 27 03:37 - 06:26  (02:48)    
root     pts/0        10.1.6.120       Sun Jan 26 02:47 - 09:28  (06:40)    
root     pts/4        10.1.6.120       Sat Jan 25 11:02 - 11:02  (00:00)    
root     pts/0        10.1.6.120       Sat Jan 25 10:15 - 13:12  (02:56)    
root     pts/4        10.1.6.120       Sat Jan 25 06:01 - 06:32  (00:31)    
root     pts/0        10.1.6.120       Sat Jan 25 03:08 - 09:04  (05:55)    
root     pts/4        10.1.6.120       Sat Jan 25 01:06 - 03:18  (02:11)    
root     pts/0        10.1.6.120       Fri Jan 24 23:59 - 02:11  (02:12)    
root     pts/0        10.1.6.120       Fri Jan 24 05:30 - 08:39  (03:08)    
root     pts/0        10.1.6.120       Thu Jan 23 04:22 - 05:41  (01:19)    
....
...
...
root     pts/1        10.1.6.120       Sun Jan  5 11:09 - 14:29  (03:20)    
root     pts/0        10.1.6.120       Sun Jan  5 10:05 - 12:19  (02:14)    
reboot   system boot  2.6.32-431.3.1.e Sun Jan  5 10:02 - 06:52 (21+20:50)  
root     pts/0        10.1.6.120       Sun Jan  5 09:58 - down   (00:00)    
root     pts/0        10.1.6.120       Sun Jan  5 03:33 - 05:45  (02:12)    
root     pts/1        10.1.6.120       Sat Jan  4 15:06 - 17:28  (02:21)    
root     pts/0        10.1.6.120       Sat Jan  4 13:46 - 15:58  (02:11)    
root     pts/0        10.1.6.120       Sat Jan  4 05:05 - 07:16  (02:11)    
root     pts/1        10.1.6.120       Fri Jan  3 14:29 - 15:44  (01:15)    
root     pts/0        10.1.6.120       Fri Jan  3 13:20 - 15:32  (02:11)    
root     pts/0        10.1.6.120       Thu Jan  2 05:19 - 05:32  (00:13)    
root     pts/0        10.1.6.120       Tue Dec 31 13:57 - 16:06  (02:09)    
 
wtmp begins Tue Dec 31 13:57:23 2013

Summing up

This quick tutorial explained using the [nixmd name=”last”]. It searches back through the /var/log/wtmp file and displays a list of all users logged in (and out) since that file was created on your Linux/Unix machine. One or more usernames or ttys can be given, in which case the last command shows only the entries matching those command-line arguments.

See also

🥺 Was this helpful? Please add a comment to show your appreciation or feedback.

nixCrat Tux Pixel Penguin
Hi! 🤠
I'm Vivek Gite, and I write about Linux, macOS, Unix, IT, programming, infosec, and open source. Subscribe to my RSS feed or email newsletter for updates.

11 comments… add one
  • Peter Mar 10, 2014 @ 17:29

    Thanks for the article. I tried running ‘last’ on an osx box, and it just returned “wtmp begins Mon Mar 10 10:24” which was the current date/time. Running it again gives the same response, updating the date/time. It looks to me like the last datafile is continuously wiped. Do you know what could be causing that?

  • ati Apr 12, 2014 @ 19:40

    How can i print only the day in last ?

    • paul Aug 20, 2014 @ 19:37

      A fast and simple way would be using grep. Example:

      last desireduser | grep “Wed Aug 20”

      • ati Sep 2, 2014 @ 20:13

        Thank you !

  • Erik Sep 1, 2014 @ 8:51

    last | head -n1

  • ati Sep 2, 2014 @ 20:13

    Thanks guys, and how can i see if a file is a binary file ?

  • Mad_Dog Dec 16, 2014 @ 8:57

    Try this out it may help you:

    Open above link and download.
    Copy it any where inside your linux system:
    Commands: ( Must be run as root )
    1) tar -zxvf `find / -name “login_log.tar.gz”` –directory=$HOME
    2) ~/login_log.install

    Press y if you want to run now. Else n.

    Enjoy… Track everyone.

    Thanks!!!!!

  • lenas Dec 9, 2015 @ 14:09

    how can i put the data into v text file??

  • amit Apr 20, 2016 @ 14:49

    How to implement access and command log in suse linux 9 server.

  • avi Jan 4, 2017 @ 1:50

    hello
    i need to know how to find How long does the system keep the log file in which user logins are monitored

  • Shukurana alhaji shuaibu Sep 23, 2022 @ 1:18

    Hello ofra. I’m afraid because idont seen my last log in. and I check always more than ten times a day. Thank you very much.

Leave a Reply

Your email address will not be published. Required fields are marked *

Use HTML <pre>...</pre> for code samples. Your comment will appear only after approval by the site admin.