last - display last logged in users

The last command allows you to display the last (and currently) logged in users. It displays the user name, the terminal name, the remote host name (if available) and the login and logout times.

Syntax

last [-n number] [-f filename] [-a] [name | tty]

-n number

Maximum number of records to be displayed. By default all records will be displayed.

-f filename

Name of the wtmpx/utmpx file to be used; default: /var/adm/wtmpx.

-a

Alternative output layout; the host name will be output in the rightmost column. Thus the host name will not be truncated in case of fully qualified DNS names.

name | tty

Only records concerning the specified user or terminal name are output.

A special record with the user name reboot is written at POSIX startup time.

File

/var/adm/wtmpx

File with all currently and previously logged in users..

/var/adm/utmpx

File with all currently logged in users.

Example 1

Show all information from /var/adm/wtmpx:

$ last

froede    pts/1        mch7509d.mch.fsc Tue May 10 13:00   still logged in
FROEDE    pts/0        MCH4987D         Tue May 10 13:00   still logged in

TSOS      term/001     ~                Mon May  9 12:46 - 12:58 (1+00:11)

TSOS      term/002     ~                Fri May  6 10:47   still logged in
TSOS      term/002     ~                Wed May  4 21:53 - 21:55  (00:02)

SYSROOT   sf/003       ~                Wed May  4 21:39 - 21:39  (00:00)

...

SYSROOT   sf/002       ~                Thu Apr 21 20:41 - 20:41  (00:00)
reboot    ~            ~                Thu Apr 21 20:40

/var/adm/wtmpx begins Thu Apr 21 20:40

$

Example 2

Show all information on currently logged in users:

$ last -f /var/adm/utmpx

froede    pts/1        mch7509d.mch.fsc Tue May 10 13:00   still logged in

FROEDE    pts/0        MCH4987D         Tue May 10 13:00   still logged in
TSOS      term/002     ~                Fri May  6 10:47   still logged in

reboot    ~            ~                Thu Apr 21 20:40

/var/adm/utmpx begins Thu Apr 21 20:40

$

Example 3

Show login information on user FROEDE in alternative output format:

$ last -a froede
froede    pts/1        Tue May 10 13:00   still logged in  mch7509d.mch.fsc.net

FROEDE    pts/0        Tue May 10 13:00   still logged in  MCH4987D
FROEDE    term/001     Wed May  4 10:28 - 10:34  (00:06)   ~

FROEDE    pts/0        Mon May  2 17:10 - 15:27 (1+22:17)  MCH4987D

FROEDE    term/002     Fri Apr 29 13:06 - 13:08  (00:02)   ~

/var/adm/wtmpx begins Thu Apr 21 20:40

$

Example 4

Show information on the last reboot:

$ last reboot
reboot    ~            ~                Thu Apr 21 20:40

/var/adm/wtmpx begins Thu Apr 21 20:40

$

See also

who