last – command

You need to use the last command to show who has recently used the server and logged in and out date/time.


To find out when a particular user last logged in to the Linux or Unix server.


The basic syntax is:

last [userNameHere]
last [tty]
last [options] [userNameHere]

If no options provided last command displays a list of all users logged in (and out) since /var/log/wtmp file was created. You can filter out results by supplying names of users and tty’s to show only those entries matching the username/tty.

Last Command Examples

# last

You can specifies a file to search other than /var/log/wtmp using -f option. For example, search /nas/server/webserver/.log/wtmp:

# last -f /nas/server/webserver/.log/wtmp

List all users last logged in/out time

last command searches back through the file /var/log/wtmp file and the output may go back to several months. Just use the less command or more command as follows to display output one screen at a time:

# last | more
last | less

List a particular user last logged in

# last [username]
# last [username] | less
# last [username] | grep ‘Thu Jan 23’

Display complete login & logout times

# last -F

Display full user/domain names

# last -w

Display last reboot time

# last reboot
# last -x reboot

Display last shutdown time

# last -x
# last -x shutdown

Find out who was logged in at a particular time

# last -t YYYYMMDDHHMMSS [username here]


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s