Linux last command

The “last” command in Linux is used to display information about previous user logins and system shutdowns/reboots. It reads the system’s wtmp or utmp log file and provides a chronological list of user login sessions, including their login times, durations, and associated terminal or remote connections. It also shows the system shutdown and reboot events.

Here is the basic syntax of the “last” command:

last [options]

Here’s a practical example of how to use the “last” command:

1. Display information about previous user logins:

   last

Running the “last” command without any options will display a list of previous user logins, showing the username, terminal or remote connection, login date and time, duration of the session, and the system’s shutdown/reboot events.

Example:

   $ last
   john     tty1                          Sat May 22 18:12    still logged in
   reboot   system boot  5.10.0-1-amd64   Sat May 22 18:09   still running
   jane     pts/0    :0.0                  Fri May 21 09:28 - 12:03  (02:35)
   john     tty1                          Wed May 19 15:47 - down   (02:21)
   reboot   system boot  5.10.0-1-amd64   Wed May 19 15:43 - 18:09  (02:25)
   jane     pts/0    :0.0                  Wed May 19 09:12 - 14:02  (04:50)

In this example, the “last” command displays a list of previous user logins, including the login sessions for users “john” and “jane”, as well as the system’s shutdown and reboot events.

2. Display information for a specific user:

   last username

Replace “username” with the actual username of the user for whom you want to check login information. This command will display login sessions specifically for that user.

Example:

   $ last john
   john     tty1                          Sat May 22 18:12    still logged in
   john     tty1                          Wed May 19 15:47 - down   (02:21)

In this example, the “last” command displays login sessions specifically for the user “john”.

The “last” command provides a historical record of user logins and system events, allowing administrators and users to track user activity, check session durations, and identify system shutdowns or reboots. Note that the output of the “last” command may vary depending on the system’s logging configuration and available log files.