# LAST(1) - man - phpman [LAST(1)](https://www.chedong.com/phpMan.php/man/LAST/1/markdown) User Commands [LAST(1)](https://www.chedong.com/phpMan.php/man/LAST/1/markdown) ## NAME last, lastb - show a listing of last logged in users ## SYNOPSIS **last** [options] [_username_...] [_tty_...] **lastb** [options] [_username_...] [_tty_...] ## DESCRIPTION **last** searches back through the _/var/log/wtmp_ file (or the file designated by the **-f** option) and displays a list of all users logged in (and out) since that file was created. One or more _usernames_ and/or _ttys_ can be given, in which case **last** will show only the entries matching those arguments. Names of _ttys_ can be abbreviated, thus **last** **0** is the same as **last** **tty0**. When catching a **SIGINT** signal (generated by the interrupt key, usually control-C) or a SIGQUIT signal, **last** will show how far it has searched through the file; in the case of the **SIGINT** signal **last** will then terminate. The pseudo user **reboot** logs in each time the system is rebooted. Thus **last** **reboot** will show a log of all the reboots since the log file was created. **lastb** is the same as **last**, except that by default it shows a log of the _/var/log/btmp_ file, which contains all the bad login attempts. ## OPTIONS ### -a --hostlast Display the hostname in the last column. Useful in combination with the **--dns** option. ### -d --dns For non-local logins, Linux stores not only the host name of the remote host, but its IP number as well. This option translates the IP number back into a hostname. ### -f --file Tell **last** to use a specific _file_ instead of _/var/log/wtmp_. The **--file** option can be given multiple times, and all of the specified files will be processed. ### -F --fulltimes Print full login and logout times and dates. ### -i --ip Like **--dns** **,** but displays the host’s IP number instead of the name. **-**_number_; **-n**, **--limit** _number_ Tell **last** how many lines to show. ### -p --present Display the users who were present at the specified time. This is like using the options **--since** and **--until** together with the same _time_. ### -R --nohostname Suppresses the display of the hostname field. ### -s --since Display the state of logins since the specified _time_. This is useful, e.g., to easily determine who was logged in at a particular time. The option is often combined with **--until**. ### -t --until Display the state of logins until the specified _time_. **--time-format** _format_ Define the output timestamp _format_ to be one of _notime_, _short_, _full_, or _iso_. The _notime_ variant will not print any timestamps at all, _short_ is the default, and _full_ is the same as the **--fulltimes** option. The _iso_ variant will display the timestamp in ISO-8601 format. The ISO format contains timezone information, making it preferable when printouts are investigated outside of the system. ### -w --fullnames Display full user names and domain names in the output. ### -x --system Display the system shutdown entries and run level changes. ## TIME FORMATS The options that take the _time_ argument understand the following formats: ┌────────────────────┬────────────────────────────────┐ │ │ │ │YYYYMMDDhhmmss │ │ ├────────────────────┼────────────────────────────────┤ │ │ │ │YYYY-MM-DD hh:mm:ss │ │ ├────────────────────┼────────────────────────────────┤ │ │ │ │YYYY-MM-DD hh:mm │ (seconds will be set to 00) │ ├────────────────────┼────────────────────────────────┤ │ │ │ │YYYY-MM-DD │ (time will be set to 00:00:00) │ ├────────────────────┼────────────────────────────────┤ │ │ │ │hh:mm:ss │ (date will be set to today) │ ├────────────────────┼────────────────────────────────┤ │ │ │ │hh:mm │ (date will be set to today, │ │ │ seconds to 00) │ ├────────────────────┼────────────────────────────────┤ │ │ │ │now │ │ ├────────────────────┼────────────────────────────────┤ │ │ │ │yesterday │ (time is set to 00:00:00) │ ├────────────────────┼────────────────────────────────┤ │ │ │ │today │ (time is set to 00:00:00) │ ├────────────────────┼────────────────────────────────┤ │ │ │ │tomorrow │ (time is set to 00:00:00) │ ├────────────────────┼────────────────────────────────┤ │ │ │ │+5min │ │ ├────────────────────┼────────────────────────────────┤ │ │ │ │-5days │ │ └────────────────────┴────────────────────────────────┘ ## FILES _/var/log/wtmp_, _/var/log/btmp_ ## NOTES The files _wtmp_ and _btmp_ might not be found. The system only logs information in these files if they are present. This is a local configuration issue. If you want the files to be used, they can be created with a simple [**touch**(1)](https://www.chedong.com/phpMan.php/man/touch/1/markdown) command (for example, **touch** **/var/log/wtmp**). ## AUTHORS Miquel van Smoorenburg <> ## SEE ALSO [**login**(1)](https://www.chedong.com/phpMan.php/man/login/1/markdown), [**wtmp**(5)](https://www.chedong.com/phpMan.php/man/wtmp/5/markdown), [**init**(8)](https://www.chedong.com/phpMan.php/man/init/8/markdown), [**shutdown**(8)](https://www.chedong.com/phpMan.php/man/shutdown/8/markdown) ## REPORTING BUGS For bug reports, use the issue tracker at . ## AVAILABILITY The **last** command is part of the util-linux package which can be downloaded from Linux Kernel Archive <>. util-linux 2.37.2 2021-06-02 [LAST(1)](https://www.chedong.com/phpMan.php/man/LAST/1/markdown)