last, lastb - show a listing of last logged in users
last [options] [username...] [tty...]
lastb [options] [username...] [tty...]
last searches back through the /var/log/wtmp file (or the file designated by the -f option) and displays a list of all users logged in (and out) since that file was created. One or more usernames and/or ttys can be given, in which case last will show only the entries matching those arguments. Names of ttys can be abbreviated, thus last 0 is the same as last tty0.
When catching a SIGINT signal (generated by the interrupt key, usually control-C) or a SIGQUIT signal, last will show how far it has searched through the file; in the case of the SIGINT signal last will then terminate.
The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all the reboots since the log file was created.
lastb is the same as last, except that by default it shows a log of the /var/log/btmp file, which contains all the bad login attempts.
-f, --file file
-number; -n, --limit number
-p, --present time
-s, --since time
-t, --until time
The options that take the time argument understand the following formats:
|YYYY-MM-DD hh:mm||(seconds will be set to 00)|
|YYYY-MM-DD||(time will be set to 00:00:00)|
|hh:mm:ss||(date will be set to today)|
|hh:mm||(date will be set to today, seconds to 00)|
|yesterday||(time is set to 00:00:00)|
|today||(time is set to 00:00:00)|
|tomorrow||(time is set to 00:00:00)|
The files wtmp and btmp might not be found. The system only logs information in these files if they are present. This is a local configuration issue. If you want the files to be used, they can be created with a simple touch(1) command (for example, touch /var/log/wtmp).
Miquel van Smoorenburg <email@example.com>
For bug reports, use the issue tracker at <https://github.com/karelzak/util-linux/issues>.
The last command is part of the util-linux package which can be downloaded from Linux Kernel Archive <https://www.kernel.org/pub/linux/utils/util-linux/>.