Open In App

last command in Linux with Examples

Improve
Improve
Like Article
Like
Save
Share
Report

The last command in Linux is used to display the list of all the users logged in and out since the file `/var/log/wtmp` was created. One or more usernames can be given as an argument to display their login in (and out) time and their host-name.

Syntax of `last` command in Linux

last [options] [username...] [tty...]

Displaying recent user logins using `last` command in Linux.

To view a list of recent user logins, simply run the last command without any options:

recent user logs

recent user logs

This command displays a chronological list of login sessions, starting with the most recent ones.

Examples and Options of the `last` command

Displaying a specific number of login entries using `last` command in Linux.

We can use the `-n` option to specify the number of login entries to display.

For example: If we want to show the last 5 login sessions, use the following command.

last -5

Output:

number of logs

number of logs

Hiding the hostname field using `last` command in Linux.

If we want to hide the hostname field in the output, we can use the `-R` option.

Example:

last -R basil
Hiding the hostname

Hiding the hostname

Displaying login and logout times with dates using `last` command in Linux.

The `-F` option can be used to display the login and logout times with their corresponding dates.

Example:

last -F
Login and logout time

Login and logout time

Displaying the hostname in the last column using `last` command in Linux.

To display the hostname in the last column of the output, we can use the `-a` option.

Example:

last -a

Filtering by a specific time period using `last` command in Linux.

The `-s` (since) and `-t` (until) options allow us to display login entries within a specific time period.

For Example: If we want to view logins from yesterday until today, use the following command.

last -s yesterday -t today

We can use various date and time formats to specify the time period.

YYYYMMDDhhmmss
YYYY-MM-DD hh:mm:ss
YYYY-MM-DD hh:mm      (seconds will be set to 00)
YYYY-MM-DD            (time will be set to 00:00:00)
hh:mm:ss              (date will be set to today)
hh:mm                 (date will be set to today, seconds to 00)
now
yesterday             (time is set to 00:00:00)
today                 (time is set to 00:00:00)
tomorrow              (time is set to 00:00:00)
+5min
-5days

Translating IP addresses into hostnames using `last` command in Linux.

If we have IP addresses in the login records and want to translate them into hostnames, we can use the `-d` option.

Example:

last -d

Displaying system down entries and run level changes using `last` command in Linux.

The `-x` option provides additional information such as system down entries and run level changes.

Example:

last -x

Displaying full user and domain names using `last` command in Linux.

To display full user and domain names in the output, use the `-w` option.

Example:

last -w basil

Help and command usage in `last` command in Linux.

If you need help regarding the options and usage of the last command, you can use the `–help` option.

Syntax:

last --help

This will display a help message providing details about all the available options for the last command.

Conclusion

In this article we have discussed about `last` command in Linux which is used for tracking user logins and exploring login history. By utilizing its various options, administrators and users can gain insights into user activity, monitory system usage, and troubleshoot issues. The examples and options discussed in this article provides a solid foundation for effectively using the `last` command and extracting meaningful information from the login records.


Last Updated : 21 Jul, 2023
Like Article
Save Article
Previous
Next
Share your thoughts in the comments
Similar Reads