LAST, LASTB(1) | User Commands | LAST, LASTB(1) |
last, lastb - show a listing of last logged in users
last [options] [username...] [tty...]
lastb [options] [username...] [tty...]
last searches back through the /var/log/wtmp file (or the file designated by the -f option) and displays a list of all users logged in (and out) since that file was created. One or more usernames and/or ttys can be given, in which case last will show only the entries matching those arguments. Names of ttys can be abbreviated, thus last 0 is the same as last tty0.
When catching a SIGINT signal (generated by the interrupt key, usually control-C) or a SIGQUIT signal, last will show how far it has searched through the file; in the case of the SIGINT signal last will then terminate.
The pseudo user reboot logs in each time the system is rebooted. Thus last reboot will show a log of all the reboots since the log file was created.
lastb is the same as last, except that by default it shows a log of the /var/log/btmp file, which contains all the bad login attempts.
The options that take the time argument understand the following formats:
YYYYMMDDhhmmss | |
YYYY-MM-DD hh:mm:ss | |
YYYY-MM-DD hh:mm | (seconds will be set to 00) |
YYYY-MM-DD | (time will be set to 00:00:00) |
hh:mm:ss | (date will be set to today) |
hh:mm | (date will be set to today, seconds to 00) |
now | |
yesterday | (time is set to 00:00:00) |
today | (time is set to 00:00:00) |
tomorrow | (time is set to 00:00:00) |
+5min | |
-5days |
/var/log/wtmp
/var/log/btmp
The files wtmp and btmp might not be found. The system only logs information in these files if they are present. This is a local configuration issue. If you want the files to be used, they can be created with a simple touch(1) command (for example, touch /var/log/wtmp).
The last command is part of the util-linux package and is available from Linux Kernel Archive.
October 2013 | util-linux |