last Command in Linux

last is a Linux command that is used to display a list of the most recent user logins on the system. It reads the information from the file /var/log/wtmp, which logs all login and logout activities. This command is pretty useful for system administrators in case they want to monitor user access and detect any unusual activity.

Table of Contents

Here is a comprehensive guide to the options available with the last command −

• Syntax for last Command
• Options Available for last Command
• Examples of last Command in Linux

Syntax for last Command

The general syntax to use the last command on Linux is given below −

last [options] [username...]

Here,

• [options] can be various flags to customize the output.
• [username...] specifies the users whose login history you want to check.

Options Available for last Command

These are some other options you can use with the Linux last command −

Examples of last Command in Linux

Here are some examples of last command that are executed on Linux system −

• List All Recent User Logins
• Display a Specific Number
• Hide Hostnames
• Show Full Timestamps
• Display Hostnames in the Last Column
• Filter by Time Period
• Translate IP Addresses to Hostnames
• Display Entries for a Specific User
• Include System Boot and Shutdown Records
• Show Reboot History

List All Recent User Logins

The basic use of the last command is to quickly view a list of recent user logins on the system. This list includes the usernames, terminal names, IP addresses, and login/logout times, which can be achieved by simply executing the following command −

last

Display a Specific Number of Entries

If you want to limit the output to a specific number of entries, you can use the -n option with last followed by the desired number. This is useful when you only need to see a few recent logins. For example, to show the last 2 login sessions, use the command −

last -n 2

Hide Hostnames

Sometimes, you might prefer not to display the hostname field in the output. This can be done using the -R option, which omits the hostname information. To hide hostnames, run the following command −

last -R

Show Full Timestamps

For displaying the login and logout times with their corresponding dates, simply use the -F option. This provides a more detailed timestamp for each session, which can be helpful for precise tracking. Use the command below to show full timestamps −

last -F

Display Hostnames in the Last Column

If you want to show the hostname in the last column of the output, you can use the -a option. This rearranges the output to place the hostname at the end. To display hostnames in the last column, execute −

last -a

Filter by Time Period

To view logins from a specific time period, utilize the -s option to specify the start time and the -t option for the end time, respectively. For example, to see logins from yesterday until today, execute the below-given command −

last -s yesterday -t today

Translate IP Addresses to Hostnames

In case you want to translate IP addresses into hostnames, you can simply use the -d option. This resolves and displays the DNS names instead of IP addresses. To translate IP addresses to hostnames, run −

last -d

Display Entries for a Specific User

To view login sessions for a specific user, you can simply add the username after the last command. For example, to see the login history of a user named ubuntu, you can use the following command −

last ubuntu

Include System Boot and Shutdown Records

To include system boot and shutdown records in the output, you can use the -x option with the command. This will show when the system was booted and shut down −

last -x

Show Reboot History

In case you want to display the history of system reboots, you can use the last command with the reboot keyword. This will list all the times the system was rebooted −

last reboot

Conclusion

The last command is a powerful utility for system administrators to track user logins and monitor system access. In this tutorial, we have covered the basic syntax, various options and a few practical examples of the command.

Whether you need to view recent logins, filter by specific time periods, or check the login history of a particular user, the last command offers a comprehensive and efficient solution. This helps you manage and audit user access on Linux systems.