dark

last – List current and past users who have logged into the system

The last command is a Linux utility that displays a list of current and past users who have logged into the system. It reads the /var/log/wtmp file, which contains a record of all successful login and logout attempts.

Overview

The basic syntax of the last command is as follows:

last [options] [username]

If no username is specified, last will display a list of all users who have logged in since the /var/log/wtmp file was created. If a username is specified, last will display only the login and logout records for that user.

Here are some examples of how to use the last command:

# Display a list of all users who have logged in since the wtmp file was created
last

# Display login and logout records for the user 'jdoe'
last jdoe

# Display the last 10 login and logout records for all users
last -n 10

# Display the login and logout records for the user 'jdoe' in reverse chronological order
last -r jdoe

Specific use cases

The last command can be useful in a variety of situations, including:

  • Monitoring user activity on a system
  • Debugging login issues
  • Auditing user activity for compliance purposes

Options

The last command supports a variety of options that can be used to customize its output. Here is a table of the most commonly used options:

Option Description
-a Display hostname and IP address information.
-d Display the date of the last login only.
-f file Use a specific wtmp file instead of the default /var/log/wtmp.
-n num Display the last num login records.
-r Display the login records in reverse chronological order.
-t YYYYMMDDHHMMSS Display login records since the specified date and time.

Troubleshooting tips

If the last command is not displaying the expected output, here are some troubleshooting tips:

  • Make sure you are running the command with the appropriate permissions (i.e. as root or with sudo).
  • Check that the /var/log/wtmp file exists and is readable.
  • If you are using a custom wtmp file with the -f option, make sure the file exists and is readable.
  • If you are not seeing any login records, it is possible that the wtmp file has been rotated or cleared. Check the /var/log/wtmp file for previous versions (e.g. /var/log/wtmp.1, /var/log/wtmp.2.gz, etc.).

Notes

  • The last command does not display failed login attempts. For that, you can use the lastb command.
  • The last command may not be available on all Linux distributions or Unix-like operating systems.

Related commands