{"id":2873,"date":"2018-02-14T17:53:36","date_gmt":"2018-02-14T14:53:36","guid":{"rendered":"https:\/\/www.howtoforge.com\/linux-last-command\/"},"modified":"2018-02-14T17:53:36","modified_gmt":"2018-02-14T14:53:36","slug":"linux-last-command-tutorial-for-beginners-8-examples","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/linux-last-command-tutorial-for-beginners-8-examples\/","title":{"rendered":"Linux last Command Tutorial for Beginners (8 Examples)"},"content":{"rendered":"

If you are new to system administration, there’ll be times when you’ll have to monitor or access login related information. There are multiple tools that you’ll likely use for this purpose, with one of them being last<\/strong>. In this tutorial, we will discuss the basic features of this utility using some easy to understand examples.<\/p>\n

Before we jump on to the explanation part, it’s worth mentioning that all examples here have been tested on an Ubuntu 16.04LTS machine.<\/p>\n

Linux last command<\/h2>\n

The last<\/strong> command displays a list of last logged in users. Following is its syntax:<\/p>\n

last [options] [username…] [tty…]\n

Here is how the man page explains this tool:<\/p>\n

 last\u00a0 searches\u00a0 back through the \/var\/log\/wtmp file (or the file desig?\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 nated by the -f option) and displays a list of all users logged in (and\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 out)\u00a0 since\u00a0 that\u00a0 file was created.\u00a0 One or more usernames and\/or ttys\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 can be given, in which case last will show only\u00a0 the\u00a0 entries\u00a0 matching\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 those\u00a0 arguments.\u00a0 Names of ttys can be abbreviated, thus last 0 is the\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 same as last tty0.
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 When catching a SIGINT signal (generated by the interrupt key,\u00a0 usually\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 control-C)\u00a0 or a SIGQUIT signal, last will show how far it has searched\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 through the file; in the case of the SIGINT signal last will then\u00a0 ter?\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 minate.<\/p>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The\u00a0 pseudo user reboot logs in each time the system is rebooted.\u00a0 Thus\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 last reboot will show a log of all the reboots since the log\u00a0 file\u00a0 was\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 created.<\/p><\/pre>\n
Following are some Q&A-styled examples that should give you a better idea on how last works.<\/p>\n
Q1. How to use last command?<\/h2>\n
The basic usage is very easy. All you have to do is to run the ‘last’ command sans any options:<\/p>\n
last<\/p>\n
\"How<\/a><\/p>\n
Q2. How to customize output in case of non-local logins?<\/h2>\n
By default, in case of non-local plugins, last command displays output in the following way:<\/p>\n
\"How<\/a><\/p>\n
Note: In the screenshot, we have intentionally blurred some parts containing IP addresses.<\/em><\/p>\n
Now, if you want, you can slightly customize this output by moving the IP address related column to extreme right. This can be done using the -a<\/strong> command line option.<\/p>\n
\"customize<\/a><\/p>\n
Q3. How to make last read a different file?<\/h2>\n
As already mentioned in the beginning of the tutorial, the last command reads the \/var\/log\/wtmp<\/strong> file to prepare its output. However, if you want, you can make the tool read a completely different file. This you can do using the -f<\/strong> command line option. Of course, you’ll have to pass the new file name (along with its path) as input to this option.<\/p>\n
last -f [new-file-path-and-name]\n
Q4. How to make last print complete date and time info?<\/h2>\n
If you want last to produce complete date and time information in output, use the -F<\/strong> command line option.<\/p>\n
last -F<\/p>\n
\"How<\/a><\/p>\n
Q5. How to make last show only a specific number of lines?<\/h2>\n
If you want to customize the number of lines the last command shows in output, you can do that using the -n<\/strong> command line option. Of course, you’ll have to pass a number to this option as input.<\/p>\n
For example:<\/p>\n
last -n 3<\/p>\n
\"How<\/a><\/p>\n
So you can see the output only contains 3 lines.<\/p>\n
Q6. How to make last suppress hostname field in output?<\/h2>\n
The third column in last’s output is hostname information. However, for some reason, if you want the tool to suppress this information, use the -R command line option.<\/p>\n
last -R<\/p>\n
\"How<\/a><\/p>\n
Q7. How to make last display info for a specific time period?<\/h2>\n
Suppose you want last to only display output based on time – say, only information from yesterday and today – then you ca use the -s<\/strong> and -t<\/strong> command line options.<\/p>\n
For example:<\/p>\n
last -s yesterday -t today<\/p>\n
\"How<\/a><\/p>\n
Please note the options that take the time argument understand the following formats:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 YYYYMMDDhhmmss\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 YYYY-MM-DD hh:mm:ss\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 YYYY-MM-DD hh:mm\u00a0\u00a0\u00a0\u00a0\u00a0 (seconds will be set to 00)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 YYYY-MM-DD\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (time will be set to 00:00:00)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 hh:mm:ss\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (date will be set to today)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 hh:mm\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (date will be set to today, seconds to 00)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 now\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 yesterday\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (time is set to 00:00:00)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 today\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (time is set to 00:00:00)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tomorrow\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 (time is set to 00:00:00)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 +5min\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 -5days<\/p><\/pre>\n
Q8. How to make last display things like run level changes?<\/h2>\n
To display information like run level changes and system shut down entries, use the -x<\/strong> command line option.<\/p>\n
last -x<\/p>\n
\"How<\/a><\/p>\n
Conclusion<\/h2>\n
Agreed, last isn’t one of those commands that you’ll use daily, but there will likely be days where this tool would be of great help. We have covered several major options here in this tutorial – should be enough to get you started. For more info, head to the utility’s man page<\/a>.<\/p>\n
\n
Share this page:<\/b><\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"
If you are new to system administration, there’ll be times when you’ll have to monitor or access login related information. There are multiple tools that you’ll likely use for this purpose, with one of them being last. In this tutorial, we will discuss the basic features of this utility using some easy to understand examples. …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[],"class_list":["post-2873","post","type-post","status-publish","format-standard","hentry","category-36"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/2873","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=2873"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/2873\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=2873"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=2873"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=2873"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}