last Command in Linux:
The last command in Linux is used to find information about previously logged-in users. It retrieves data from the /var/log/wtmp file, which stores login and logout information. The output includes details like the username, connection method, IP address (for remote connections), duration of login, and date/time.
Syntax:
last
Example:
$ last
Output Explanation
The first column shows the username of the logged-in user. The second column indicates how the user is connected to the system. For example, pts signifies a pseudo-terminal used for remote connections. :0 indicates a local terminal. The third column displays the user’s IP address for remote connections or :0 for local terminals. In cases of system reboots, the kernel version is shown. The remaining columns show the timing activity of users, including the duration for which they were logged in.
Options
last -n <number>: Display a specified number of lines.
$ last -n 5
last -R: Disable displaying the hostname.
$ last -R
last -a: Display the hostname in the last column.
$ last -a
last -F: Display full login and logout time.
$ last -F
last <username>: Display information for a specific username.
$ last siliconvlsilast -x: Display the last shutdown time.
$ last -x
These options provide flexibility in tailoring the output based on specific requirements, such as limiting the number of lines, including hostnames, or focusing on a particular username.