The “last” command in Linux is used to display information about previous user logins and system shutdowns/reboots. It reads the system’s wtmp or utmp log file and provides a chronological list of user login sessions, including their login times, durations, and associated terminal or remote connections. It also shows the system shutdown and reboot events.
Here is the basic syntax of the “last” command:
Here’s a practical example of how to use the “last” command:
- Display information about previous user logins:
Running the “last” command without any options will display a list of previous user logins, showing the username, terminal or remote connection, login date and time, duration of the session, and the system’s shutdown/reboot events.
$ last john tty1 Sat May 22 18:12 still logged in reboot system boot 5.10.0-1-amd64 Sat May 22 18:09 still running jane pts/0 :0.0 Fri May 21 09:28 - 12:03 (02:35) john tty1 Wed May 19 15:47 - down (02:21) reboot system boot 5.10.0-1-amd64 Wed May 19 15:43 - 18:09 (02:25) jane pts/0 :0.0 Wed May 19 09:12 - 14:02 (04:50)
In this example, the “last” command displays a list of previous user logins, including the login sessions for users “john” and “jane”, as well as the system’s shutdown and reboot events.
- Display information for a specific user:
Replace “username” with the actual username of the user for whom you want to check login information. This command will display login sessions specifically for that user.
$ last john john tty1 Sat May 22 18:12 still logged in john tty1 Wed May 19 15:47 - down (02:21)
In this example, the “last” command displays login sessions specifically for the user “john”.
The “last” command provides a historical record of user logins and system events, allowing administrators and users to track user activity, check session durations, and identify system shutdowns or reboots. Note that the output of the “last” command may vary depending on the system’s logging configuration and available log files.