The last command displays the history of user login and logout actions, along with the actual time and date. It also has options that enable you to filter users who have logged in through a specific terminal. For example, last 1 will display the details of users who logged in using the first terminal. The last command retrieves information from the /var/log/wtmp file.
Syntax
The syntax of the last command is:
# last [options]
Displaying user login/logout history.
last Command Examples
1. To see the list of last logged in users:
# last
2. To specify last to use mentioned file instead of /var/log/wtmp:
# last -f /path/file
3. To restrict last to show specified number of lines:
# last -num 10 # last -n 10
4. To display the state of logins for specified time:
# last -t YYYYMMDDHHMMSS # last -t 20140627081600
5. To suppress the display of hostname field:
# last -R
6. To display the hostname in last column:
# last -a
7. To translate the IP to hostname for remote logins:
# last -d
8. To print the full login and logout time and dates:
# last -F
9. To display the IP in numbers and dots for remote logins:
# last -i
10. To display the full user and domain name in output:
# last -w
11. To display the system shutdown entries and run level changes:
# last -x