last(1)
Show a listing of last logins and logouts on the system.
Synopsis
last [OPTION]... [USER]... [TTY]...Description
The last command displays a list of last logged in users, extracted from the /var/log/wtmp file. It shows login/logout times, connection duration, and terminal information for each session.
By default, last shows the most recent entries first. You can filter by username, terminal, or other criteria to narrow the results.
Common options
| Flag | What it does |
|---|---|
-f FILE | Read from FILE instead of /var/log/wtmp |
-n NUM | Show only NUM lines of output |
-a | Display the hostname in the last column instead of in a separate column |
-d | Interpret addresses as IPv4 dotted notation and hostnames or IPv6 addresses |
-F | Print full login and logout times and dates |
-i | Display IP addresses instead of hostnames |
-p | Suppress the <code>name of the pseudo or console device</code> column |
-t YYYYMMDDHHMMSS | Show only logins before the specified timestamp |
-w | Display full user names and domain names |
-x | Display the system shutdown or reboot entries and run level changes |
Examples
Display all login/logout records in reverse chronological order
lastShow the 10 most recent login/logout entries
last -n 10Show all login/logout records for user 'john'
last johnDisplay login records with IP addresses instead of hostnames
last -iShow login times with full date and time format
last -FShow system shutdowns, reboots, and runlevel changes (limit to 20 entries)
last -x | head -20View login history from an archived wtmp log file
last -f /var/log/wtmp.1Show login records for the specific terminal pts/0
last pts/0