1LAST(1) User Commands LAST(1)
2
6 last, lastb - show a listing of last logged in users
7
9 last [options] [username...] [tty...]
10 lastb [options] [username...] [tty...]
12
14 last searches back through the /var/log/wtmp file (or the file
15 designated by the -f option) and displays a list of all users logged in
16 (and out) since that file was created. One or more usernames and/or
17 ttys can be given, in which case last will show only the entries
18 matching those arguments. Names of ttys can be abbreviated, thus last 0
19 is the same as last tty0.
20 When catching a SIGINT signal (generated by the interrupt key, usually
22 control-C) or a SIGQUIT signal, last will show how far it has searched
23 through the file; in the case of the SIGINT signal last will then
24 terminate.
25 The pseudo user reboot logs in each time the system is rebooted. Thus
27 last reboot will show a log of all the reboots since the log file was
28 created.
29 lastb is the same as last, except that by default it shows a log of the
31 /var/log/btmp file, which contains all the bad login attempts.
32
34 -a, --hostlast
35 Display the hostname in the last column. Useful in combination with
36 the --dns option.
37 -d, --dns
39 For non-local logins, Linux stores not only the host name of the
40 remote host, but its IP number as well. This option translates the
41 IP number back into a hostname.
42 -f, --file file
44 Tell last to use a specific file instead of /var/log/wtmp. The
45 --file option can be given multiple times, and all of the specified
46 files will be processed.
47 -F, --fulltimes
49 Print full login and logout times and dates.
50 -i, --ip
52 Like --dns , but displays the host’s IP number instead of the name.
53 -number; -n, --limit number
55 Tell last how many lines to show.
56 -p, --present time
58 Display the users who were present at the specified time. This is
59 like using the options --since and --until together with the same
60 time.
61 -R, --nohostname
63 Suppresses the display of the hostname field.
64 -s, --since time
66 Display the state of logins since the specified time. This is
67 useful, e.g., to easily determine who was logged in at a particular
68 time. The option is often combined with --until.
69 -t, --until time
71 Display the state of logins until the specified time.
72 --time-format format
74 Define the output timestamp format to be one of notime, short,
75 full, or iso. The notime variant will not print any timestamps at
76 all, short is the default, and full is the same as the --fulltimes
77 option. The iso variant will display the timestamp in ISO-8601
78 format. The ISO format contains timezone information, making it
79 preferable when printouts are investigated outside of the system.
80 -w, --fullnames
82 Display full user names and domain names in the output.
83 -x, --system
85 Display the system shutdown entries and run level changes.
86 -h, --help
88 Display help text and exit.
89 -V, --version
91 Print version and exit.
92
94 The options that take the time argument understand the following
95 formats:
96 ┌────────────────────┬───────────────────────────┐
98 │ │ │
99 │YYYYMMDDhhmmss │ │
100 ├────────────────────┼───────────────────────────┤
101 │ │ │
102 │YYYY-MM-DD hh:mm:ss │ │
103 ├────────────────────┼───────────────────────────┤
104 │ │ │
105 │YYYY-MM-DD hh:mm │ (seconds will be set to │
106 │ │ 00) │
107 ├────────────────────┼───────────────────────────┤
108 │ │ │
109 │YYYY-MM-DD │ (time will be set to │
110 │ │ 00:00:00) │
111 ├────────────────────┼───────────────────────────┤
112 │ │ │
113 │hh:mm:ss │ (date will be set to │
114 │ │ today) │
115 ├────────────────────┼───────────────────────────┤
116 │ │ │
117 │hh:mm │ (date will be set to │
118 │ │ today, seconds to 00) │
119 ├────────────────────┼───────────────────────────┤
120 │ │ │
121 │now │ │
122 ├────────────────────┼───────────────────────────┤
123 │ │ │
124 │yesterday │ (time is set to 00:00:00) │
125 ├────────────────────┼───────────────────────────┤
126 │ │ │
127 │today │ (time is set to 00:00:00) │
128 ├────────────────────┼───────────────────────────┤
129 │ │ │
130 │tomorrow │ (time is set to 00:00:00) │
131 ├────────────────────┼───────────────────────────┤
132 │ │ │
133 │+5min │ │
134 ├────────────────────┼───────────────────────────┤
135 │ │ │
136 │-5days │ │
137 └────────────────────┴───────────────────────────┘
138
140 /var/log/wtmp, /var/log/btmp
141
143 The files wtmp and btmp might not be found. The system only logs
144 information in these files if they are present. This is a local
145 configuration issue. If you want the files to be used, they can be
146 created with a simple touch(1) command (for example, touch
147 /var/log/wtmp).
148 An empty entry is a valid type of wtmp entry. It means that an empty
150 file or file with zeros is not interpreted as an error.
151 The utmp file format uses fixed sizes of strings, which means that very
153 long strings are impossible to store in the file and impossible to
154 display by last. The usual limits are 32 bytes for a user and line name
155 and 256 bytes for a hostname.
156
158 Miquel van Smoorenburg <miquels@cistron.nl>
159
161 login(1), wtmp(5), init(8), shutdown(8)
162
164 For bug reports, use the issue tracker at
165 https://github.com/util-linux/util-linux/issues.
166
168 The last command is part of the util-linux package which can be
169 downloaded from Linux Kernel Archive
170 <https://www.kernel.org/pub/linux/utils/util-linux/>.
171util-linux 2.39.2 2023-06-14 LAST(1)