The last command displays the history of user login and logout actions, along with the actual time and date. It also has options that enable you to filter users who have logged in through a specific terminal. For example, last 1 will display the details of users who logged in using the first terminal. The last command retrieves information from the /var/log/wtmp file.
Syntax
The syntax of the last command is:
$ last [options]
The last command displays a history of logins, in reverse chronological order.
$ last user01 pts/3 localhost Mon Sep 8 21:07 - 21:08 (00:01) user02 pts/6 :0 Mon Sep 8 20:25 - 20:56 (00:31) user03 pts/4 myhost Sun Sep 7 22:19 still logged in ...
Command line options
| Option | Description |
|---|---|
| -N | Print only the latest N lines of output, where N is a positive integer. |
| -i | Display IP addresses instead of hostnames. |
| -R | Don’t display hostnames. |
| -x | Also display system shutdowns and changes in system runlevel (e.g., from single-user mode into multiuser mode). |
| -f filename | Read from some other data file than /var/run/wtmp; see the who command for more details. |
If you encounter below error while running the last command:
last: command not found
you may try installing the below package as per your choice of distribution:
| Distribution | Command |
|---|---|
| OS X | brew install util-linux |
| Debian | apt-get install util-linux |
| Ubuntu | apt-get install util-linux |
| Alpine | apk add util-linux |
| Arch Linux | pacman -S util-linux |
| Kali Linux | apt-get install util-linux |
| CentOS | yum install sysvinit-tools |
| Fedora | dnf install util-linux |
| Raspbian | apt-get install util-linux |
last Command Examples
1. To see the list of last logged in users:
# last
2. To specify last to use mentioned file instead of /var/log/wtmp:
# last -f /path/file
3. To restrict last to show specified number of lines:
# last -num 10 # last -n 10
4. To display the state of logins for specified time:
# last -t YYYYMMDDHHMMSS # last -t 20140627081600
5. To suppress the display of hostname field:
# last -R
6. To display the hostname in last column:
# last -a
7. To translate the IP to hostname for remote logins:
# last -d
8. To print the full login and logout time and dates:
# last -F
9. To display the IP in numbers and dots for remote logins:
# last -i
10. To display the full user and domain name in output:
# last -w
11. To display the system shutdown entries and run level changes:
# last -x
12. Print the full date and time for entries and then display the hostname column last to prevent truncation:
# last -F -a
13. View all recorded reboots (i.e., the last logins of the pseudo user “reboot”):
# last reboot
14. View all recorded shutdowns (i.e., the last logins of the pseudo user “shutdown”):
# last shutdown
15. View all logins by a specific user and show the IP address instead of the hostname:
# last username -i