Back to Commands

last

systemLinux/Unix

The last command is one of the most frequently used commands in Linux/Unix-like operating systems. last Show listing of last logged in users

See Examples View Syntax

Quick Reference

Command Name:

last

Category:

system

Platform:

Linux/Unix

Basic Usage:

last [options] [arguments]

Common Use Cases

Syntax

last [options] [username...] [tty...]

Options

Option	Description
`-a, --hostlast`	Display hostname in the last column
`-d, --dns`	Translate IP addresses to hostnames
`-f, --file file`	Use specified file instead of /var/log/wtmp
`-F, --fulltimes`	Print full login and logout times and dates
`-i, --ip`	Display IP addresses instead of hostnames
`-n, --limit N`	Show only the last N entries
`-R, --nohostname`	Don't display the hostname field
`-s, --since time`	Display entries since the specified time
`-t, --until time`	Display entries until the specified time
`-p, --present time`	Display users who were present at the specified time
`-w, --fullnames`	Display full user and domain names
`-x, --system`	Display system shutdown entries and run level changes
`--time-format format`	Show timestamps in the specified format
`-h, --help`	Display help message
`-V, --version`	Display version information

Examples

How to Use These Examples

The examples below show common ways to use the last command. Try them in your terminal to see the results. You can copy any example by clicking on the code block.

# Basic Examples Basic

last

Show all recent logins.

last -n 10

Show only the last 10 logins.

last john

Show recent logins by user 'john'. # Advanced Examples Advanced last -F Show full timestamps for login/logout times. last reboot Show system reboot history. last -s 2023-01-01 -t 2023-01-31 Show logins between Jan 1 and Jan 31, 2023. last -x Show system shutdown entries and run level changes. last -a Display hostname in the last column. last -i Show IP addresses instead of hostnames. last -f /var/log/wtmp.1 Show login information from an alternate file.

Try It Yourself

Practice makes perfect! The best way to learn is by trying these examples on your own system with real files.

Understanding Syntax

Pay attention to the syntax coloring: commands, options, and file paths are highlighted differently.

Notes

The 'last' command is a valuable system utility that displays a chronological listing of user logins, system reboots, and shutdowns. It reads data from the system's wtmp file, which maintains a history of all logins and logouts on the system. Key features of the last command: 1. Login History Tracking: last provides a comprehensive view of who has logged into the system, when they logged in, how long they stayed, and from where they connected (terminal or IP address). 2. System Uptime Analysis: By showing reboot records, last helps administrators track system uptime and identify patterns in system restarts, which is useful for reliability monitoring and troubleshooting. 3. Security Monitoring: The command serves as a basic security tool by showing unauthorized or suspicious login attempts, unusual login times, or unexpected remote access. 4. Time Range Filtering: With options like --since and --until, administrators can focus on specific time periods when investigating incidents or auditing system usage. 5. Format Flexibility: last offers various display formats including full timestamps, IP address display, and customizable output, making it adaptable to different analysis needs. 6. Historical Data Access: The ability to read from alternate wtmp files (including rotated logs) allows for historical analysis beyond the current log file. 7. System Event Tracking: When used with the -x option, last also shows system shutdown events and runlevel changes, providing a more complete picture of system state changes. Common use cases for the last command include: - Security auditing and investigating potential unauthorized access - Troubleshooting login problems - Monitoring system usage patterns - Checking system uptime and reboot history - Verifying user activity claims - Generating reports on system utilization - Identifying the source of remote connections - Determining when and how a system was shut down The last command is available on most Unix-like operating systems including Linux and BSD variants. It's a standard tool in the system administrator's toolkit and is often used in conjunction with other logging and auditing tools to maintain system security and reliability.

Related Commands

These commands are frequently used alongside last or serve similar purposes:

Explore All Commands

Use Cases

Learn By Doing

The best way to learn Linux commands is by practicing. Try out these examples in your terminal to build muscle memory and understand how the last command works in different scenarios.

See Examples Try Lab Exercises

$ last

View All Commands