last Command Cheat Sheet

The last command searches back through the file /var/log/wtmp (or the file designated by the -f flag) and displays a list of all users logged in (and out) since that file was created.

Synopsis

last [OPTIONS] [USER] [TTY]

Basic Usage

Show Recent Logins

last

Output format:

username  pts/0        192.168.1.50     Fri Feb 14 10:00 - 10:30  (00:30)
reboot    system boot  5.15.0-91-generi Fri Feb 14 09:55   still running

Limit Output (-n)

Show only the last 10 entries.

last -n 10

Or simply:

last -10

Filtering

By User

last root
last alice

By Terminal (TTY)

Monitor physical or pseudo-terminal access.

last tty1
last pts/0

By Time

Not supported directly by flag in older sysvinit versions, but modern util-linux version supports:

last --since "2024-01-01" --until "2024-02-01"

If your last doesn't support this, pipe to head or grep is the traditional way.

System Events

Reboot History

Check when the system was rebooted/shutdown.

last reboot
last shutdown

Runlevel Changes

Show system runlevel changes (e.g., maintenance mode).

last -x runlevel

File Selection

Failed Logins (lastb)

The lastb command is essentially last reading from /var/log/btmp (bad logins). Equivalent to:

sudo last -f /var/log/btmp

Useful for checking brute-force attacks.

Archived Logs

Log rotation moves wtmp to wtmp.1. To read old logs:

last -f /var/log/wtmp.1

Output formatting

Full Date/Time (-F)

Show full timestamp instead of abbreviated format.

last -F

Hostname (-d)

Translate IP addresses into Hostnames (DNS lookup).

last -d

No Hostname (-i)

Show IP addresses always (faster, default on many systems).

last -i

Notes

wtmp vs utmp vs btmp:
- wtmp: Historical login records (last).
- utmp: Current login status (who, w).
- btmp: Failed login attempts (lastb).
If wtmp is deleted, last shows nothing.
"still logged in" means the session hasn't been closed (or the system crashed before writing the logout record).