Linux last command

last show us who login into the system since the last reboot/turn-on of the machine.
Who is still logged in, in what terminal they are logged in, and the date and time of their log-in.

In the example below we run last command in a Linux machine:


oren@oren-computer:~/c-programming  
$ last 
oren     tty7         :0               Fri Sep  9 01:24    gone - no logout
reboot   system boot  4.4.0-36-generic Fri Sep  9 01:19   still running
oren     tty1                          Fri Sep  9 01:04 - down   (00:14)
oren     tty7         :0               Fri Sep  9 00:54 - down   (00:24)
reboot   system boot  4.4.0-36-generic Fri Sep  9 00:27 - 01:18  (00:51)
oren     tty7         :0               Fri Sep  2 18:51 - crash (6+05:35)
reboot   system boot  4.4.0-36-generic Fri Sep  2 18:47 - 01:18 (6+06:30)
oren     tty1                          Fri Sep  2 18:30 - down   (00:15)

wtmp begins Fri Sep  2 18:30:37 2016

The last line “wtmp begins Fri Sep 2 18:30:37 2016” tell us the log that contain this information.
In this case it is in /var/log/wtmp, the log file is in binary format.
If we want information about specific user, we can run:
last <userName>

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s