Last

lastmod 2025-12-04created 2018-12-267 edits

Examines users' login information in various ways. This command is also used to check a server's reboot information.

Features

• Logged-in account name
• Connection device name
• Connecting IP address
• Connection duration: how long the user stayed on the server after connecting
• Connection period: weekday, month, day, and time of the connection - etc.
• System reboot information

About

The last command shows its output by reading the /var/log/wtmp file, which records the connection information of all accounts. If the /var/log/wtmp file does not exist, create it with the touch /var/log/wtmp command, because Linux records connection information only when the /var/log/wtmp file exists. (Or /var/log/messages)

Examples

• last - Shows all login/logout and system startup/shutdown records.
• last -F - Shows times in detail, including the year.
• last -[number] - Sets the maximum number of lines to print. (Most recent first)
• last [account name] - Shows the login/logout records of a specific account.
• last reboot - Shows the system reboot log.

See also

• Linux:Logging
• linux
• write
• wall
• mesg
• mail
• biff
• who
• w
• last - Check login and reboot logs
• lastlog - View login logs
• lastb - View failed login logs

Favorite site

• (Linux) Checking user connection information
• last(1) — Linux manual page
• wtmp(5) — Linux manual page
• [Linux Checking server down (shutdown) logs]
• (Linux) Checking ssh login failure logs, login Fail log