Linux Last

Education is not limited to just classrooms. It can be gained anytime, anywhere... - Ravi Ranjan (M.Tech-NIT)

last

The last command is used to find out last logged in timing of a user. It shows a list of last logged in users from /var/log/wtmp file since this file was created. Hence, this list is too long.

It gives all related information like who is logged in, IP address (if there is a remote connection), duration for logged in, date and time.

Syntax:>

last

Linux-last1

Look at the above snapshot,

  • First column shows logged in user
  • Second column shows how a user is connected to the system here, pts is pseudo terminal pts0 means user connects via remote connection system boot indicates the exception for reboot activity
  • Third column shows user's address if it shows :0 it means it is connected via local terminal it shows IP address if it is connected via remote server kernel version is shown as the exception in system reboot
  • Remaining columns display timing activity of the users
  • Bracket data indicates for how much time user was logged in

Options

Option Function
last -n Display specified number of lines
last -R Disable displaying hostname
last -a Display hostname in last column
last -F Display full login and logout time
last Display specific username
last -x Display last shutdown time