last—Indicate last logins by user or terminal
last [–number][–f filename][–t tty][–h hostname][–i address][–l][–y][name…]
Last looks back in the wtmp file, which records all logins and logouts for information about a user, a teletype, or any group of users and teletypes. Arguments specify names of users or teletypes of interest. If multiple arguments are given, the information that applies to any of the arguments is printed. For example last root console would list all of root’s sessions as well as all sessions on the console terminal. Last displays the sessions of the specified users and teletypes, most recent first, indicating the times at which the session began, the duration of the session, and the teletype that the session took place on. If the session is still continuing or was cut short by a reboot, last so indicates.
The pseudo-user reboot logs in at reboots of the system.
Last with no arguments displays a record of all logins and logouts, in reverse order.
If last is interrupted, it indicates how far the search has progressed in wtmp. If interrupted with a quit signal, last indicates how far the search has progressed so far, and the search continues.
|–number||Limit the number of entries displayed to that specified by number.|
|–f filename||Use filename as the name of the accounting file instead of /var/log/wtmp.|
|–h hostname||List only logins from hostname.|
|–i IP address||List only logins from IP address.|
|–l||List IP addresses of remote hosts instead of truncated hostnames.|
|–t tty||List only logins on tty.|
|–y||Also report year of dates.|