Linux last Command

Linux 命令大全Linux Command Reference

The Linux last command is used to display users' recent login information.

When executed alone,lastthe command reads the file named wtmp located in the /var/log/ directory and displays all the usernames recorded in that file.

Syntax

last [options] [username...] [tty...]

Parameter description：

options:

  • -R Omit the hostname column
  • -a Display the hostname or IP address from which the user logged into the system on the last line.
  • -d Convert IP addresses into hostnames.
  • -f<record file> Specify the record file.
  • -n<number of lines> or -<number of lines> Display the number of lines in the list.
  • -R Do not display the hostname or IP address used to log into the system.
  • -x Display information such as system shutdown, reboot, and runlevel changes.

username:

  • username: Display the login information for the specified user username.

tty:

  • tty Set the terminal for login; the tty name can be abbreviated,last 0andlast tty0the same.

Examples

Display two lines and omit the hostname column:

# last -R -2
root     pts/0        Thu Apr 28 18:06   still logged in
root     pts/0        Tue Apr 26 09:06 - 19:36  (10:30)

wtmp begins Sun Apr  3 13:11:25 2022

Display two lines and omit the host column:

~# last -R -2
root     pts/0        Thu Apr 28 18:06   still logged in
root     pts/0        Tue Apr 26 09:06 - 19:36  (10:30)

wtmp begins Sun Apr  3 13:11:25 2022

General display method:

# last
...
root   pts/4    Thu May 13 17:25  still logged in  
root   pts/2    Thu May 13 17:23 - 17:25 (00:02)  
root   pts/1    Thu May 13 16:46  still logged in  
...

Brief display, and specify the number of entries to show:

# last -n 5 -R
root   pts/4    Thu May 13 17:25  still logged in  
root   pts/2    Thu May 13 17:23 - 17:25 (00:02)  
root   pts/1    Thu May 13 16:46  still logged in  
root   pts/7    Thu May 13 15:36  still logged in  
root   pts/9    Thu May 13 15:35  still logged in  

wtmp begins Thu May 13 18:55:40 2014

Display the host IP address in the last column:

# last -n 5 -a -i
root   pts/4    Thu May 13 17:25  still logged in  192.168.1.10
root   pts/2    Thu May 13 17:23 - 17:25 (00:02)   192.168.1.10
root   pts/1    Thu May 13 16:46  still logged in  192.168.1.10
root   pts/7    Thu May 13 15:36  still logged in  192.168.1.10
root   pts/9    Thu May 13 15:35  still logged in  192.168.1.10

wtmp begins Thu May 13 18:55:40 2014

Linux 命令大全Linux Command Reference

Other extensions