In Linux systems, understanding the system’s login history is crucial for system management and security auditing. The last command helps us easily view the system’s login history records. Today, let’s learn about this super useful command—last.1. What is the last Command?The last command is used to display the system’s login history. It lists the login and logout times of all users, remote host addresses, terminals, and other information. The last command is very convenient for daily use, especially when monitoring system activity or troubleshooting issues.Before diving deeper into the last command, it is recommended to check its official documentation to understand all available options and usages. Enter the following command in the terminal:
man last2. Usage of the last CommandBasic command format:
last [options] [username] [terminal]Common options:
- -a: Display the remote hostname in the last column.
- -d: Display logged-out users.
- -f file: Specify the login record file to read, default is /var/log/wtmp.
- -h: Display help information.
- -i: Display terminal ID.
- -n number: Only display the specified number of recent login records.
- -s time: Display login records starting from the specified time.
- -t time: Display login records up to the specified time.
- -x: Display records of system shutdowns, reboots, and runlevel changes.
3. Example OperationsExample 1: View All Login History
last# This command will display the complete login history of the system, including all users' login and logout times, remote host addresses, terminals, and other information.Example 2: View Login History of a Specific User
last shishun# This command will only display the login history of user shishun.Example 3: View the Last 10 Login Records
last -n 10# This command will only display the last 10 login records.Example 4: View Login Records Starting from a Specified Time
last -s "2025-03-20"# This command will display login records starting from March 20, 2025.Example 5: View Login Records Up to a Specified Time
last -t "2025-03-20"# This command will display login records up to March 20, 2025.Example 6: View System Shutdown and Reboot Records
last -x# This command will display the system's shutdown and reboot records.4. Practical TipsScenario 1: Analyzing User Login PatternsIn daily work, you may need to analyze user login patterns. You can use the following command to view the login history of a specific user:
last shishun# This command will display all login history records of user shishun, helping to analyze their login patterns.5. NotesEnvironmental Differences: Different Linux distributions and environments may have slight differences, but the basic usage of the last command is generally consistent.Permission Requirements: The last command usually does not require special permissions to execute, as it only reads the system’s login record files.6. Interactive SectionQuestion 1: How to use the last command to view the login history of user shishun?Question 2: How to view login records starting from March 20, 2025, using the last command?If you already know the answers, or if you have other questions while using the last command, feel free to leave a comment for discussion! Let’s communicate and improve together.
— END —
It is not easy to write, and I feel honored to have you along the way.Your every 【follow】, 【like】, 【share】 and 【view】 are the warmest encouragement for me. Thank you for being by my side! If you wish to continue receiving my latest articles, remember to 【star us】! Want to see more exciting content? Click the tags below to explore more selected articles!
Selected Past Articles:
Essential for Linux Beginners! The usermod Command: Easily Manage User Accounts
Essential for Linux Beginners! The chage Command: Manage User Password Expiration
Essential for Linux Beginners! The passwd Command: Easily Manage User Passwords
Essential for Linux Beginners! The w Command: Easily View System User Activity
Essential for Linux Beginners! The who Command: Easily View Current Logged-in Users