blob: 719a0ede9f2b7279a1abf1fe5deedcf1122f6a4c [file] [log] [blame]
.\" Copyright (C) 1998-2004 Miquel van Smoorenburg.
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation; either version 2 of the License, or
.\" (at your option) any later version.
.\" This program is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" GNU General Public License for more details.
.\" You should have received a copy of the GNU General Public License
.\" along with this program; if not, write to the Free Software
.\" Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
.TH "LAST, LASTB" "1" "October 2013" "util-linux" "User Commands"
last, lastb \- show a listing of last logged in users
.B last
.RI [ username "...] [" tty ...]
.B lastb
.RI [ username "...] [" tty ...]
.B last
searches back through the
.B /var/log/wtmp
file (or the file designated by the
.B \-f
option) and displays a list of all users logged in (and out) since that
file was created. One or more
.IR usernames " and/or " ttys
can be given, in which case
.B last
will show only the entries matching those arguments. Names of
.I ttys
can be abbreviated, thus
.B last 0
is the same as
.BR "last tty0" .
When catching a \s-2SIGINT\s0 signal (generated by the interrupt key, usually
control-C) or a \s-2SIGQUIT\s0 signal,
.B last
will show how far it has searched through the file; in the case of the
\s-2SIGINT\s0 signal
.B last
will then terminate.
The pseudo user
.B reboot
logs in each time the system is rebooted. Thus
.B last reboot
will show a log of all the reboots since the log file was created.
.B lastb
is the same as
.BR last ,
except that by default it shows a log of the
.BR /var/log/btmp
file, which contains all the bad login attempts.
.BR \-a , " \-\-hostlast"
Display the hostname in the last column. Useful in combination with the
.B \-\-dns
.BR \-d , " \-\-dns"
For non-local logins, Linux stores not only the host name of the remote
host, but its IP number as well. This option translates the IP number
back into a hostname.
.BR \-f , " \-\-file " \fIfile\fR
.B last
to use a specific \fIfile\fR instead of
.BR /var/log/wtmp .
.B \-\-file
option can be given multiple times, and all of the specified files will be
.BR \-F , " \-\-fulltimes"
Print full login and logout times and dates.
.BR \-i , " \-\-ip"
.B \-\-dns ,
but displays the host's IP number instead of the name.
.BI \- number
.BR \-n , " -\-limit " \fInumber\fR
.B last
how many lines to show.
.BR \-p , " \-\-present " \fItime\fR
Display the users who were present at the specified time. This is
like using the options
.BR \-\-since " and " \-\-until
together with the same \fItime\fR.
.BR \-R , " \-\-nohostname"
Suppresses the display of the hostname field.
.BR \-s , " \-\-since " \fItime\fR
Display the state of logins since the specified
.IR time .
This is useful, e.g., to easily determine who was logged in at a
particular time. The option is often combined with
.BR \-\-until .
.BR \-t , " \-\-until " \fItime\fR
Display the state of logins until the specified
.IR time .
.BI \-\-time\-format " format"
Define the output timestamp
.I format
to be one of
.IR notime ,
.IR short ,
.IR full ,
.IR iso .
.I notime
variant will not print any timestamps at all,
.I short
is the default, and
.I full
is the same as the
.B \-\-fulltimes
option. The
.I iso
variant will display the timestamp in ISO-8601 format. The ISO format
contains timezone information, making it preferable when printouts are
investigated outside of the system.
.BR \-w , " \-\-fullnames"
Display full user names and domain names in the output.
.BR \-x , " \-\-system"
Display the system shutdown entries and run level changes.
The options that take the
.I time
argument understand the following formats:
left l2 l.
YYYY-MM-DD hh:mm:ss
YYYY-MM-DD hh:mm (seconds will be set to 00)
YYYY-MM-DD (time will be set to 00:00:00)
hh:mm:ss (date will be set to today)
hh:mm (date will be set to today, seconds to 00)
yesterday (time is set to 00:00:00)
today (time is set to 00:00:00)
tomorrow (time is set to 00:00:00)
The files
.I wtmp
.I btmp
might not be found. The system only logs information in these files if
they are present. This is a local configuration issue. If you want the
files to be used, they can be created with a simple
.BR touch (1)
command (for example,
.IR "touch /var/log/wtmp" ).
Miquel van Smoorenburg
The last command is part of the util-linux package and is available from
.UR ftp://\\:/pub\:/linux\:/utils\:/util-linux/
Linux Kernel Archive
.UE .
.BR shutdown (8),
.BR login (1),
.BR init (8)