Linux last Command

Show Login History

Overview

The last command displays a list of user logins and system boots by reading the wtmp log file. It shows information about when users logged in and out of the system, including login duration and terminal information. This command is essential for system monitoring and security auditing.

Key Features:
  • Display user login and logout history
  • Show system boot and shutdown records
  • Filter by username, terminal, or hostname
  • Display login duration and session information
  • Support for different log file formats

Syntax

last [OPTIONS] [username] [tty]

Common Options

Option Description
-n NUM Display only NUM lines of output
-f FILE Read from specified log file instead of /var/log/wtmp
-t DATE Display logins before specified date
-s DATE Display logins since specified date
-i Display IP addresses instead of hostnames
-a Display hostname in last column
-d Translate IP addresses to hostnames
-x Display system shutdown and runlevel changes

Basic Examples

Display Recent Logins

last
john pts/0 192.168.1.100 Mon Jan 15 10:30 still logged in
mary tty1 Mon Jan 15 09:15 - 10:25 (01:10)
reboot system boot 5.4.0-74-generic Mon Jan 15 09:00 - 10:35 (01:35)

Show Login History for Specific User

last john
john pts/0 192.168.1.100 Mon Jan 15 10:30 still logged in
john pts/0 192.168.1.100 Sun Jan 14 15:20 - 18:45 (03:25)

Limit Number of Results

last -n 5
john pts/0 192.168.1.100 Mon Jan 15 10:30 still logged in
mary tty1 Mon Jan 15 09:15 - 10:25 (01:10)
reboot system boot 5.4.0-74-generic Mon Jan 15 09:00 - 10:35 (01:35)

Related Commands

User Information:
  • who - Show currently logged in users
  • w - Show logged in users and their activity
  • users - Display usernames of logged in users
System Monitoring:
  • lastb - Show failed login attempts
  • lastlog - Show last login times
  • uptime - Show system uptime

Frequently Asked Questions

The last command displays a list of user logins and system boots by reading the wtmp log file. It shows when users logged in and out of the system, including login duration and terminal information.

Use last username to show login history for a specific user. For example, last john will show all login sessions for the user 'john'.

"Still logged in" indicates that the user session is currently active and the user has not logged out yet. The session duration will continue to increase until the user logs out.

Use the lastb command to view failed login attempts. This reads from the /var/log/btmp file and shows unsuccessful login attempts, which is useful for security monitoring.

Yes, use the -s option to specify a start date and -t option for an end date. For example: last -s "2024-01-10" -t "2024-01-15" shows logins between those dates.