last show us who login into the system since the last reboot/turn-on of the machine.
Who is still logged in, in what terminal they are logged in, and the date and time of their log-in.
In the example below we run last command in a Linux machine:
oren@oren-computer:~/c-programming $ last oren tty7 :0 Fri Sep 9 01:24 gone - no logout reboot system boot 4.4.0-36-generic Fri Sep 9 01:19 still running oren tty1 Fri Sep 9 01:04 - down (00:14) oren tty7 :0 Fri Sep 9 00:54 - down (00:24) reboot system boot 4.4.0-36-generic Fri Sep 9 00:27 - 01:18 (00:51) oren tty7 :0 Fri Sep 2 18:51 - crash (6+05:35) reboot system boot 4.4.0-36-generic Fri Sep 2 18:47 - 01:18 (6+06:30) oren tty1 Fri Sep 2 18:30 - down (00:15) wtmp begins Fri Sep 2 18:30:37 2016
The last line “wtmp begins Fri Sep 2 18:30:37 2016” tell us the log that contain this information.
In this case it is in /var/log/wtmp, the log file is in binary format.
If we want information about specific user, we can run: