Overview
The last command reads the system's `wtmp` log file and outputs events such as user logins/logouts, system reboots, and runlevel changes in reverse chronological order. It is an essential tool for system security auditing and usage history analysis.
Key Events Tracked
- User login/logout records
- System reboot (reboot) records
- System shutdown records
- Runlevel change records
Key Options
The main options of the last command help control the amount and format of the output information, allowing you to efficiently retrieve the desired data.
Display and Filtering
Generated command:
Try combining the commands.
Description:
`last` Executes the command.
Combine the above options to virtually execute commands with AI.
Usage Examples
Learn how to effectively query system logs through various usage examples of the last command.
View all login and reboot records
lastDisplays all login and reboot records of the system in reverse chronological order.
View only the last 10 records
last -n 10Outputs only the 10 most recent events.
View only system reboot records
last rebootFilters and displays only records of system reboot times.
View login records for a specific user
last rootDisplays login and logout records only for the specified user (e.g., root).
View records in full time format
last -FDisplays login and logout times in full format, including year, month, day, hour, minute, and second.
Tips & Precautions
The last command analyzes important system log files, so it is crucial to understand its usage and precautions.
- Log File Location: The last command analyzes the `/var/log/wtmp` file. This file is in binary format and should not be edited directly.
- Related Commands: The `lastb` command reads and displays records of failed login attempts from the `/var/log/btmp` file. It is useful to use them together for security audits.
- Permissions: Regular users can execute the `last` command, but they need read permission for the `wtmp` file.
- Timezone: The recorded times follow the system's local timezone. Be cautious when comparing with systems in different timezones.