am a new Linux and Unix system user. How can I find out last logins of users and ttys on Linux/Unix-like operating systems?
You need to use thelast command to show who has recently used the server and logged in and out date/time. This page explains last command examples for Linux and Unix developers.
| last command details | |
|---|---|
| Description | Show last logged in users. |
| Category | User Information |
| Difficulty level | Easy |
| Root privileges | Yes |
| OS compatibility | *BSD • Linux • macOS • Unix • WSL |
| Est. reading time | 4 minutes |
| Table of contents ↓ * 1 Syntax * 2 Examples * 3 List all users last logged in/out time * 4 List a particular user last logged in * 5 Hide hotnames * 6 Display complete login & logout times * 7 Display full user/domain names * 8 Display last reboot time * 9 Display last shutdown time * 10 Find out particular logged in time * 11 See bad login attempts * 12 Video tutorials * 13 Summing up |
Purpose ↑
To find out when a particular user last logged in to the Linux or Unix server.
Unix and Linux sysadmin is responsible for managing a multi-user server system. Often, they need to find out details about user login. Hence, we use the last command. Please note that the last command reads listing of last logged in users from the system file called /var/log/wtmp or the file designated by the -f options.
Syntax ↑
The basic syntax is:
last
last [userNameHere]
last [tty]
last [options] [userNameHere]If no options provided last command displays a list of all users logged in (and out) since /var/log/wtmp file was created. You can filter out results by supplying names of users and tty's to show only those entries matching the username or tty.
Linux last command examples ↑
To find out who has recently logged in and out on your server, type:
last
Here is what I see:
root pts/1 10.1.6.120 Tue Jan 28 05:59 still logged in
root pts/0 10.1.6.120 Tue Jan 28 04:08 still logged in
root pts/0 10.1.6.120 Sat Jan 25 06:33 - 08:55 (02:22)
root pts/1 10.1.6.120 Thu Jan 23 14:47 - 14:51 (00:03)
root pts/0 10.1.6.120 Thu Jan 23 13:02 - 14:51 (01:48)
root pts/0 10.1.6.120 Tue Jan 7 12:02 - 12:38 (00:35)
wtmp begins Tue Jan 7 12:02:54 2014Understanding the last command outputs
Let us consider the following output line:
root pts/0 10.1.6.120 Tue Jan 28 04:08 still logged in- root -- It is the user name. For example, for system events such as reboot and shutdown of the Linux/Unix box, unique user names reboot and shutdown are used to indicate that activity.
- pts/0 -- Explains how the user logged into the system. For instance, pts for pseudoterminal session (ssh login), tty for the terminal, :0, :1, (:2) X windows GUI system, etc.
- 10.1.6.120 -- The IP address or the FQDN (or hostname) from which the user logged into the system.
- Tue Jan 28 04:08 -- The date and time stamp for the user login activity (the log in time).
- still logged in -- The logout time.
Of course, you can specifies a file to search other than /var/log/wtmp using -f option. For example, search /nas/server/webserver/.log/wtmp:
last -f /nas/server/webserver/.log/wtmp
last -f /nas/server/webserver/.log/wtmp userNameHere
last command in Linux with example outputs
Pass the -n to limit the number of lines to show on the screen. For example, only display 10 lines, run:
last -n 10
last -n 10 reboot
Last 10 reboots times for AWS server:
reboot system boot 5.13.0-1019-aws Wed Mar 23 07:50 still running
reboot system boot 5.13.0-1017-aws Wed Mar 16 21:49 - 07:50 (6+10:00)
reboot system boot 5.13.0-1017-aws Fri Mar 11 09:55 - 21:49 (5+11:53)
reboot system boot 5.13.0-1014-aws Sat Mar 5 09:07 - 09:54 (6+00:47)
reboot system boot 5.11.0-1028-aws Wed Feb 2 08:11 - 09:07 (31+00:55)
reboot system boot 5.11.0-1027-aws Thu Jan 20 04:22 - 08:11 (13+03:48)
reboot system boot 5.11.0-1025-aws Tue Jan 11 11:03 - 04:21 (8+17:18)
reboot system boot 5.11.0-1022-aws Tue Dec 14 22:08 - 11:02 (27+12:53)
reboot system boot 5.11.0-1022-aws Tue Nov 30 19:29 - 22:08 (14+02:38)
reboot system boot 5.11.0-1021-aws Thu Nov 18 10:57 - 19:28 (12+08:30)
wtmp begins Sun Jun 27 20:53:20 2021List all users last logged in/out time ↑
last command searches back through the file /var/log/wtmp file and the output may go back to several months. Just use the less command or more command as follows to display output one screen at a time:
last | more
last | less
How to list a particular user last logged in ↑
To find out when user vivek last logged in, type:
last vivek
last vivek | less
last vivek | grep 'Thu Jan 23'
Fig. 01 Displaying out when user vivek last logged in on server
Hide hotnames when using the last command ↑
To hide the display of the hostname field pass -R option:
last -R
last -R vivek
Sample outputs:
root pts/1 Tue Jan 28 05:59 still logged in
root pts/0 Tue Jan 28 04:08 still logged in
root pts/0 Sat Jan 25 06:33 - 08:55 (02:22)
root pts/1 Thu Jan 23 14:47 - 14:51 (00:03)
root pts/0 Thu Jan 23 13:02 - 14:51 (01:48)
root pts/0 Tue Jan 7 12:02 - 12:38 (00:35)
wtmp begins Tue Jan 7 12:02:54 2014Show complete login and logout times ↑
By default, year is now displayed by last command. You can force last command to display full login and logout times and dates by passing -F option. For instance:
last -F
Here is what we see:
root pts/1 10.1.6.120 Tue Jan 28 05:59:08 2014 still logged in
root pts/0 10.1.6.120 Tue Jan 28 04:08:01 2014 still logged in
root pts/0 10.1.6.120 Sat Jan 25 06:33:11 2014 - Sat Jan 25 08:55:11 2014 (02:22)
root pts/1 10.1.6.120 Thu Jan 23 14:47:42 2014 - Thu Jan 23 14:51:31 2014 (00:03)
root pts/0 10.1.6.120 Thu Jan 23 13:02:51 2014 - Thu Jan 23 14:51:27 2014 (01:48)
root pts/0 10.1.6.120 Tue Jan 7 12:02:54 2014 - Tue Jan 7 12:38:03 2014 (00:35)
wtmp begins Tue Jan 7 12:02:54 2014Display full user/domain names ↑
last -w
Display last reboot time ↑
The user reboot logs in each time the system is rebooted. Thus following command will show a log of all reboots since the log file was created:
last reboot
last -x reboot
Sample outputs:
reboot system boot 2.6.32-431.3.1.e Sun Jan 5 09:33 - 06:20 (22+20:46)
reboot system boot 2.6.32-431.1.2.e Sat Dec 14 12:00 - 09:30 (21+21:29)
reboot system boot 2.6.32-431.el6.x Sat Nov 23 03:08 - 11:57 (21+08:48)
....
..
...
reboot system boot 2.6.32-220.2.1.e Mon Jan 23 17:48 - 17:50 (00:02)
reboot system boot 2.6.32-131.0.15. Mon Jan 23 17:37 - 17:44 (00:07)
wtmp begins Mon Jan 23 17:37:02 2012Display last shutdown time ↑
Find out the system shutdown entries and run level changes:
last -x
last -x shutdown
Sample outputs:
shutdown system down 2.6.32-431.1.2.e Sun Jan 5 09:30 - 09:33 (00:03)
shutdown system down 2.6.32-431.el6.x Sat Dec 14 11:57 - 12:00 (00:03)
....
..
..
shutdown system down 2.6.32-220.2.1.e Mon Jan 23 17:50 - 17:53 (00:03)
shutdown system down 2.6.32-131.0.15. Mon Jan 23 17:45 - 17:48 (00:03) Find out who was logged in at a particular time ↑
The syntax is as follows to see the state of logins as of the specified time:
last -t YYYYMMDDHHMMSS
last -t YYYYMMDDHHMMSS userNameHere
In other words you can display the lines until the specified time formats:
YYYYMMDDhhmmss
YYYY-MM-DD hh:mm:ss
YYYY-MM-DD hh:mm (seconds will be set to 00)
YYYY-MM-DD (time will be set to 00:00:00)
hh:mm:ss (date will be set to today)
hh:mm (date will be set to today, seconds to 00)
now
yesterday (time is set to 00:00:00)
today (time is set to 00:00:00)
tomorrow (time is set to 00:00:00)
+5min
-5daysHence, we can use the following syntax:
last -t now
last -t +5min vivek
`
see last three days login activity on linux for 'vivek' user #`
last -t -3days vivek
See bad login attempts ↑
Use the lastb command as follows:
lastb
[sudo] password for vivek:
root ssh:notty 192.168.2.17 Sat Apr 2 00:00 - 00:00 (00:00)
root ssh:notty 192.168.2.17 Sat Apr 2 00:00 - 00:00 (00:00)
root ssh:notty 192.168.2.17 Fri Apr 1 00:00 - 00:00 (00:00)
root ssh:notty 192.168.2.17 Fri Apr 1 00:00 - 00:00 (00:00)
btmp begins Fri Apr 1 00:00:45 2022Related: Find Out All Failed SSHD Login Attempts on Linux / Unix
Related media ↑
This tutorial is also available in a quick video format:
Summing up ↑
You learned about the last command under Linux and Unix-like system. Do read the following manual pages using the man command or help command:
man 1 last
man 5 wtmp