Linux last Command Tutorial for Beginners (8 Examples)
On this page
- Linux last command
- Q1. How to use last command?
- Q2. How to customize output in case of non-local logins?
- Q3. How to make last read a different file?
- Q4. How to make last print complete date and time info?
- Q5. How to make last show only a specific number of lines?
- Q6. How to make last suppress hostname field in output?
- Q7. How to make last display info for a specific time period?
- Q8. How to make last display things like run level changes?
If you are new to system administration, there'll be times when you'll have to monitor or access login related information. There are multiple tools that you'll likely use for this purpose, with one of them being last. In this tutorial, we will discuss the basic features of this utility using some easy to understand examples.
Before we jump on to the explanation part, it's worth mentioning that all examples here have been tested on an Ubuntu 16.04LTS machine.
Linux last command
The last command displays a list of last logged in users. Following is its syntax:
last [options] [username...] [tty...]
Here is how the man page explains this tool:
last searches back through the /var/log/wtmp file (or the file desig?
nated by the -f option) and displays a list of all users logged in (and
out) since that file was created. One or more usernames and/or ttys
can be given, in which case last will show only the entries matching
those arguments. Names of ttys can be abbreviated, thus last 0 is the
same as last tty0.
When catching a SIGINT signal (generated by the interrupt key, usually
control-C) or a SIGQUIT signal, last will show how far it has searched
through the file; in the case of the SIGINT signal last will then ter?
The pseudo user reboot logs in each time the system is rebooted. Thus
last reboot will show a log of all the reboots since the log file was
Following are some Q&A-styled examples that should give you a better idea on how last works.
Q1. How to use last command?
The basic usage is very easy. All you have to do is to run the 'last' command sans any options:
Q2. How to customize output in case of non-local logins?
By default, in case of non-local plugins, last command displays output in the following way:
Note: In the screenshot, we have intentionally blurred some parts containing IP addresses.
Now, if you want, you can slightly customize this output by moving the IP address related column to extreme right. This can be done using the -a command line option.
Q3. How to make last read a different file?
As already mentioned in the beginning of the tutorial, the last command reads the /var/log/wtmp file to prepare its output. However, if you want, you can make the tool read a completely different file. This you can do using the -f command line option. Of course, you'll have to pass the new file name (along with its path) as input to this option.
last -f [new-file-path-and-name]
Q4. How to make last print complete date and time info?
If you want last to produce complete date and time information in output, use the -F command line option.
Q5. How to make last show only a specific number of lines?
If you want to customize the number of lines the last command shows in output, you can do that using the -n command line option. Of course, you'll have to pass a number to this option as input.
last -n 3
So you can see the output only contains 3 lines.
Q6. How to make last suppress hostname field in output?
The third column in last's output is hostname information. However, for some reason, if you want the tool to suppress this information, use the -R command line option.
Q7. How to make last display info for a specific time period?
Suppose you want last to only display output based on time - say, only information from yesterday and today - then you ca use the -s and -t command line options.
last -s yesterday -t today
Please note the options that take the time argument understand the following formats:
YYYY-MM-DD hh:mm (seconds will be set to 00)
YYYY-MM-DD (time will be set to 00:00:00)
hh:mm:ss (date will be set to today)
hh:mm (date will be set to today, seconds to 00)
yesterday (time is set to 00:00:00)
today (time is set to 00:00:00)
tomorrow (time is set to 00:00:00)
Q8. How to make last display things like run level changes?
To display information like run level changes and system shut down entries, use the -x command line option.
Agreed, last isn't one of those commands that you'll use daily, but there will likely be days where this tool would be of great help. We have covered several major options here in this tutorial - should be enough to get you started. For more info, head to the utility's man page.