Last Command in Linux with Example – View History of User Logins

it The last The Commands Guide is a follow-up to my previous 90 Linux Commands Frequently Used by Linux Sysadmins article. Every week, or as time permits, I will publish articles on about 90 commands geared towards Linux sysadmins and Linux power users. let’s continue this series last Permission.

You will be working with other system administrators and developers, who must all be logged into the same system. At some point, you’ll want to see a list of end users who logged in, from where, and at what time. meet The last Commands for Linux and Unix-like systems.

last command example

last command usually reads from log file /var/log/wtmp and prints the history of successful user login attempts as well as any currently logged-in users. The last logged-in users appear at the top of the list. We will also look at similar commands, namely: lastb And lastlog,

To see last logins, their duration and other details, use:


To show only the last 10 logins, use:

last -n 10

To print the full date and time of entries along with their IP, use:

last -F

To see all logins by a specific user and show the IP address instead of the hostname, use:

last username

To see all recorded reboots, use:

last reboot

To see all recorded shutdowns, use:

last shutdown

to check when the file was /var/log/wtmp was written last, use:

stat /var/log/wtmp

You can also filter by users or TTSin which case last Will only show entries matching those arguments. Ttys can be abbreviated. for example, last 7 is the same as last tty7,

Lastb Command Example

lastb is the same as lastexcept that it shows the log of the last failed login attempts.

To show a list of all failed login attempts, use:

sudo lastb

To show a list of failed login attempts since a certain amount of time, use:

sudo lastb --since YYYY-MM-DD

To show a list of failed login attempts up to a certain amount of time, use:

sudo lastb --until YYYY-MM-DD

To show a list of all failed login attempts at a specific time, use:

sudo lastb --present hh:mm

These options apply to both last And lastb,

The screenshots and excerpts below are from here: man last,

-a, -hostlast – Display the hostname in the last column. Useful in conjunction with the -dns option.

-d, -dns – For non-local logins, Linux not only stores the hostname of the remote host but also its IP number. This option converts the IP number back to the hostname.

-f, -file – Tell last to use a specific file instead of /var/log/wtmp . The -file option can be given multiple times, and all specified files will be processed.

-f, -full time – Print complete login and logout times and dates.

-i, -ip –like-dns, but displays the host’s IP number instead of the name.

-n, -limit number At the end, tell how many lines to show.

-p, -current time – Display users who were present at the specified time. it’s like using
The options -from and -to at the same time.

-r, -nohostname – Suppresses the display of the hostname field.

-s, -since time – Display login status from the specified time. This is useful, for example, for easily determining who was logged in at a particular time. The option is often combined with -until .

-t, -till time – Display login status up to the specified time.

-time-format format – Define the output timestamp format as one of NOTIM, SHORT, FULL, or ISO. The nottime version will not print any timestamps at all, short is the default, and is the same as the full-time option. The ISO version will display the timestamp in ISO-8601 format. The ISO format contains time zone information, which makes it better when checking printouts outside the system.

-w, -fullname – Display full username and domain name in the output.

-x, -system – Display system shutdown entries and play level changes.

lastlog command with examples

is also useful lastlog Permission. lastlog The command shows the latest login for all users or for a specific user.

To show the latest login of all users, use:


To show a specific user’s record, use:

lastlog -u username

To show logins older than 1 day, use:

lastlog -b 1

To show records more than 7 days recent, use:

lastlog -t 7

Sorting output:

For all these commands (The last, lastbyAnd lastlog), you can reverse the output using tac, for example:

last | tac

Related orders:

  • Who? – Print who is currently logged in.
  • w – Quick summary of each user logged into the computer.
  • lastcom – List the last executed commands of the user.


If you are accessing Linux servers with other system administrators and developers, last, lastbAnd lastlog Provide fast way to view list of last and currently logged-in users.

Leave a Comment