Docu review done: Mon 03 Jul 2023 17:08:52 CEST

Table of content

General
Commands and Descriptions
Samples

General

last searches back through the /var/log/wtmp file (or the file designated by the -f option) and displays a list of all users logged in (and out) since that file was created. One or more usernames and/or ttys can be given, in which case last will show only the entries matching those arguments. Names of ttys can be abbreviated, thus last 0 is the same as last tty0.

When catching a SIGINT signal (generated by the interrupt key, usually control-C) or a SIGQUIT signal, last will show how far it has searched through the file; in the case of the SIGINT signal last will then terminate.

The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all the reboots since the log file was created.

lastb is the same as last, except that by default it shows a log of the /var/log/btmp file, which contains all the bad login attempts.

Commands and Descriptions

Command	Description
`-f`\|`--file [logfile]`	Tell `last` to use a specific file instead of `/var/log/wtmp`. The `--file` option can be given multiple times, and all of the specified files will be processed.
`-s`\|`--since [date/time]`	Display the state of logins since the specified time.
`-t`\|`--until [date/time]`	Display the state of logins until the specified time.
`-p`\|`--present [date/time]`	This is like using the options `--since` and `--until` together with the same time.
`-x`\|`--system`	Display the system shutdown entries and run level changes.

Samples

last on pts1

$ last pts/1
<username> pts/1        o                Thu May  5 11:23 - 11:23  (00:00)
<username> pts/1        o                Thu May  5 11:23 - 11:23  (00:00)
<username> pts/1        o                Thu May  5 11:16 - 11:23  (00:07)
<username> pts/1        o                Tue Apr 26 08:13 - 11:16 (9+03:02)
<username> pts/1        o                Mon Apr 25 11:10 - crash  (19:02)
<username> pts/1        o                Fri Apr 15 12:38 - 11:10 (9+22:32)
<username> pts/1        o                Fri Apr 15 12:06 - crash  (-1:29)
<username> pts/1        o                Fri Apr 15 09:19 - crash  (00:46)

wtmp begins Fri Apr  8 08:15:23 2022

last user

$ last <usrename>
<username> pts/0        tmux(1182042).%0 Thu May  5 11:44 - 11:45  (00:00)
<username> pts/0        tmux(1181292).%0 Thu May  5 11:44 - 11:44  (00:00)
<username> pts/0        tmux(1180425).%0 Thu May  5 11:42 - 11:43  (00:00)
<username> pts/20       o                Thu May  5 11:23   still logged in
<username> pts/1        o                Thu May  5 11:23 - 11:23  (00:00)
<username> pts/1        o                Thu May  5 11:23 - 11:23  (00:00)
<username> pts/1        o                Thu May  5 11:16 - 11:23  (00:07)
<username> pts/9        tmux(1013115).%7 Thu May  5 09:49 - 09:59  (00:10)
<username> pts/9        tmux(1013115).%6 Thu May  5 09:49 - 09:49  (00:00)
<username> pts/2        tmux(1013115).%5 Thu May  5 09:44 - 09:56  (00:12)
...

last since until

$ last --since "-1days" --until "now"
<username> pts/0        tmux(1182042).%0 Thu May  5 11:44 - 11:45  (00:00)
<username> pts/0        tmux(1181292).%0 Thu May  5 11:44 - 11:44  (00:00)
<username> pts/0        tmux(1180425).%0 Thu May  5 11:42 - 11:43  (00:00)
<username> pts/20       o                Thu May  5 11:23   still logged in
<username> pts/1        o                Thu May  5 11:23 - 11:23  (00:00)
<username> pts/1        o                Thu May  5 11:23 - 11:23  (00:00)
<username> pts/1        o                Thu May  5 11:16 - 11:23  (00:07)
<username> pts/9        tmux(1013115).%7 Thu May  5 09:49 - 09:59  (00:10)
<username> pts/9        tmux(1013115).%6 Thu May  5 09:49 - 09:49  (00:00)
<username> pts/2        tmux(1013115).%5 Thu May  5 09:44 - 09:56  (00:12)
<username> pts/2        tmux(1013115).%4 Thu May  5 09:39 - 09:41  (00:01)
<username> pts/9        tmux(1013115).%3 Thu May  5 09:23 - 09:34  (00:10)
<username> pts/2        tmux(1013115).%2 Thu May  5 08:45 - 08:56  (00:10)
<username> pts/17       tmux(1013115).%1 Thu May  5 08:13 - 08:17  (00:04)
<username> pts/7        tmux(1013115).%0 Wed May  4 17:11 - 09:44  (16:32)
<username> pts/7        tmux(1003632).%0 Wed May  4 16:50 - 17:01  (00:10)
<username> pts/15       tmux(977083).%1  Wed May  4 16:27 - 16:29  (00:02)
<username> pts/5        tmux(977083).%0  Wed May  4 16:26 - 16:29  (00:02)
<username> pts/5        tmux(871366).%0  Wed May  4 13:00 - 13:11  (00:11)
<username> pts/5        tmux(837604).%1  Wed May  4 12:17 - 12:52  (00:34)
<username> pts/3        tmux(837604).%0  Wed May  4 12:17 - 13:02  (00:44)

$ last --since "2022-05-03 10:10" --until "2022-05-04 12:30"
<username> pts/5        tmux(837604).%1  Wed May  4 12:17   still logged in
<username> pts/3        tmux(837604).%0  Wed May  4 12:17   still logged in
<username> pts/15       tmux(698547).%0  Tue May  3 16:53 - 17:04  (00:10)
<username> pts/9        tmux(673222).%0  Tue May  3 16:25 - 16:34  (00:09)
<username> pts/5        tmux(637180).%1  Tue May  3 15:37 - 17:40  (02:03)
<username> pts/3        tmux(637180).%0  Tue May  3 15:37 - 17:40  (02:03)
<username> pts/12       tmux(585087).%0  Tue May  3 14:05 - 14:15  (00:10)
<username> pts/14       tmux(501457).%3  Tue May  3 13:12 - 13:13  (00:00)
<username> pts/5        tmux(553218).%1  Tue May  3 13:12 - 15:37  (02:25)
<username> pts/3        tmux(553218).%0  Tue May  3 13:12 - 15:37  (02:25)
<username> pts/15       tmux(501457).%2  Tue May  3 13:07 - 13:11  (00:03)
<username> pts/15       tmux(501457).%1  Tue May  3 12:58 - 13:07  (00:08)
<username> pts/12       tmux(501457).%0  Tue May  3 11:51 - 13:52  (02:00)
<username> pts/9        tmux(430896).%0  Tue May  3 10:17 - 10:27  (00:10)

Sharing is caring