Linux last Command Tutorial for Beginners (8 Examples)
On this page
- Linux last command
- Q1. How to use the last command?
- Q2. How to customize the output in case of non-local logins?
- Q3. How to make last read a different file?
- Q4. How to make last print complete date and time info?
- Q5. How to make last show only a specific number of lines?
- Q6. How to make last suppress hostname field in output?
- Q7. How to make last display info for a specific time period?
- Q8. How to make last display things like run level changes?
If you are new to system administration, you will sometimes need to access or monitor credentials. There are several tools you will probably use for this purpose, and one of them is last. In this tutorial, we will explain the basic functions of this program with some easy-to-understand examples.
Before we get to the explanations, we should mention that all the examples here have been tested on an Ubuntu 20.04 and Ubuntu 22.04 LTS system, but they should work in the exact same way on any recent Linux distribution.
Linux last command
The last command displays a list of the last logged-in users. Following is its syntax:
last [options] [username...] [tty...]
Here is how the man page explains this tool:
last searches back through the /var/log/wtmp file (or the file desig?
nated by the -f option) and displays a list of all users logged in (and
out) since that file was created. One or more usernames and/or ttys
can be given, in which case last will show only the entries matching
those arguments. Names of ttys can be abbreviated, thus last 0 is the
same as last tty0.
When catching a SIGINT signal (generated by the interrupt key, usually
control-C) or a SIGQUIT signal, last will show how far it has searched
through the file; in the case of the SIGINT signal last will then ter?
The pseudo user reboot logs in each time the system is rebooted. Thus
last reboot will show a log of all the reboots since the log file was
Following are some Q&A-styled examples that should give you a better idea on how last works.
Q1. How to use the last command?
The basic usage is very easy. All you have to do is to run the 'last' command sans any options:
Q2. How to customize the output in case of non-local logins?
By default, in case of non-local plugins, last command displays output in the following way:
Note: In the screenshot, we have intentionally blurred some parts containing IP addresses.
Now, if you want, you can slightly customize this output by moving the IP address related column to extreme right. This can be done using the -a command line option.
Q3. How to make last read a different file?
As already mentioned in the beginning of the tutorial, the last command reads the /var/log/wtmp file to prepare its output. However, if you want, you can make the tool read a completely different file. This you can do using the -f command line option. Of course, you'll have to pass the new file name (along with its path) as input to this option.
last -f [new-file-path-and-name]
Q4. How to make last print complete date and time info?
If you want last to produce complete date and time information in output, use the -F command line option.
Q5. How to make last show only a specific number of lines?
If you want to customize the number of lines the last command shows in output, you can do that using the -n command line option. Of course, you'll have to pass a number to this option as input.
last -n 3
So you can see the output only contains 3 lines.
Q6. How to make last suppress hostname field in output?
The third column in last's output is hostname information. However, for some reason, if you want the tool to suppress this information, use the -R command line option.
Q7. How to make last display info for a specific time period?
Suppose you want last to only display output based on time - say, only information from yesterday and today - then you ca use the -s and -t command line options.
last -s yesterday -t today
Please note the options that take the time argument understand the following formats:
YYYY-MM-DD hh:mm (seconds will be set to 00)
YYYY-MM-DD (time will be set to 00:00:00)
hh:mm:ss (date will be set to today)
hh:mm (date will be set to today, seconds to 00)
yesterday (time is set to 00:00:00)
today (time is set to 00:00:00)
tomorrow (time is set to 00:00:00)
Q8. How to make last display things like run level changes?
To display information like run level changes and system shut down entries, use the -x command line option.
Agreed, last isn't one of those commands that you'll use daily, but there will likely be days where this tool would be of great help. We have covered several major options here in this tutorial - should be enough to get you started. For more info, head to the utility's man page.