| .\" Copyright (C) 1998-2004 Miquel van Smoorenburg. |
| .\" |
| .\" This program is free software; you can redistribute it and/or modify |
| .\" it under the terms of the GNU General Public License as published by |
| .\" the Free Software Foundation; either version 2 of the License, or |
| .\" (at your option) any later version. |
| .\" |
| .\" This program is distributed in the hope that it will be useful, |
| .\" but WITHOUT ANY WARRANTY; without even the implied warranty of |
| .\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| .\" GNU General Public License for more details. |
| .\" |
| .\" You should have received a copy of the GNU General Public License |
| .\" along with this program; if not, write to the Free Software |
| .\" Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA |
| .\" |
| .TH "LAST, LASTB" "1" "October 2013" "util-linux" "User Commands" |
| .SH NAME |
| last, lastb \- show a listing of last logged in users |
| .SH SYNOPSIS |
| .B last |
| [options] |
| .RI [ username "...] [" tty ...] |
| .br |
| .B lastb |
| [options] |
| .RI [ username "...] [" tty ...] |
| .SH DESCRIPTION |
| .B last |
| searches back through the |
| .I /var/log/wtmp |
| file (or the file designated by the |
| .B \-f |
| option) and displays a list of all users logged in (and out) since that |
| file was created. One or more |
| .IR usernames " and/or " ttys |
| can be given, in which case |
| .B last |
| will show only the entries matching those arguments. Names of |
| .I ttys |
| can be abbreviated, thus |
| .B last 0 |
| is the same as |
| .BR "last tty0" . |
| .PP |
| When catching a SIGINT signal (generated by the interrupt key, usually |
| control-C) or a SIGQUIT signal, |
| .B last |
| will show how far it has searched through the file; in the case of the |
| SIGINT signal |
| .B last |
| will then terminate. |
| .PP |
| The pseudo user |
| .B reboot |
| logs in each time the system is rebooted. Thus |
| .B last reboot |
| will show a log of all the reboots since the log file was created. |
| .PP |
| .B lastb |
| is the same as |
| .BR last , |
| except that by default it shows a log of the |
| .IR /var/log/btmp |
| file, which contains all the bad login attempts. |
| .SH OPTIONS |
| .TP |
| .BR \-a , " \-\-hostlast" |
| Display the hostname in the last column. Useful in combination with the |
| .B \-\-dns |
| option. |
| .TP |
| .BR \-d , " \-\-dns" |
| For non-local logins, Linux stores not only the host name of the remote |
| host, but its IP number as well. This option translates the IP number |
| back into a hostname. |
| .TP |
| .BR \-f , " \-\-file " \fIfile\fR |
| Tell |
| .B last |
| to use a specific \fIfile\fR instead of |
| .IR /var/log/wtmp . |
| The |
| .B \-\-file |
| option can be given multiple times, and all of the specified files will be |
| processed. |
| .TP |
| .BR \-F , " \-\-fulltimes" |
| Print full login and logout times and dates. |
| .TP |
| .BR \-i , " \-\-ip" |
| Like |
| .B \-\-dns , |
| but displays the host's IP number instead of the name. |
| .TP |
| .BI \- number |
| .TQ |
| .BR \-n , " -\-limit " \fInumber\fR |
| Tell |
| .B last |
| how many lines to show. |
| .TP |
| .BR \-p , " \-\-present " \fItime\fR |
| Display the users who were present at the specified time. This is |
| like using the options |
| .BR \-\-since " and " \-\-until |
| together with the same \fItime\fR. |
| .TP |
| .BR \-R , " \-\-nohostname" |
| Suppresses the display of the hostname field. |
| .TP |
| .BR \-s , " \-\-since " \fItime\fR |
| Display the state of logins since the specified |
| .IR time . |
| This is useful, e.g., to easily determine who was logged in at a |
| particular time. The option is often combined with |
| .BR \-\-until . |
| .TP |
| .BR \-t , " \-\-until " \fItime\fR |
| Display the state of logins until the specified |
| .IR time . |
| .TP |
| .BI \-\-time\-format " format" |
| Define the output timestamp |
| .I format |
| to be one of |
| .IR notime , |
| .IR short , |
| .IR full , |
| or |
| .IR iso . |
| The |
| .I notime |
| variant will not print any timestamps at all, |
| .I short |
| is the default, and |
| .I full |
| is the same as the |
| .B \-\-fulltimes |
| option. The |
| .I iso |
| variant will display the timestamp in ISO-8601 format. The ISO format |
| contains timezone information, making it preferable when printouts are |
| investigated outside of the system. |
| .TP |
| .BR \-w , " \-\-fullnames" |
| Display full user names and domain names in the output. |
| .TP |
| .BR \-x , " \-\-system" |
| Display the system shutdown entries and run level changes. |
| .SH TIME FORMATS |
| The options that take the |
| .I time |
| argument understand the following formats: |
| .TS |
| left l2 l. |
| YYYYMMDDhhmmss |
| YYYY-MM-DD hh:mm:ss |
| YYYY-MM-DD hh:mm (seconds will be set to 00) |
| YYYY-MM-DD (time will be set to 00:00:00) |
| hh:mm:ss (date will be set to today) |
| hh:mm (date will be set to today, seconds to 00) |
| now |
| yesterday (time is set to 00:00:00) |
| today (time is set to 00:00:00) |
| tomorrow (time is set to 00:00:00) |
| +5min |
| -5days |
| .TE |
| .SH NOTES |
| The files |
| .I wtmp |
| and |
| .I btmp |
| might not be found. The system only logs information in these files if |
| they are present. This is a local configuration issue. If you want the |
| files to be used, they can be created with a simple |
| .BR touch (1) |
| command (for example, |
| .IR "touch /var/log/wtmp" ). |
| .SH FILES |
| /var/log/wtmp |
| .br |
| /var/log/btmp |
| .SH AUTHOR |
| .MT miquels@cistron.nl |
| Miquel van Smoorenburg |
| .ME |
| .SH AVAILABILITY |
| The last command is part of the util-linux package and is available from |
| .UR https://\:www.kernel.org\:/pub\:/linux\:/utils\:/util-linux/ |
| Linux Kernel Archive |
| .UE . |
| .SH "SEE ALSO" |
| .BR login (1), |
| .BR wtmp (5), |
| .BR init (8), |
| .BR shutdown (8) |