last Command
Intermediate User Management man(1)Show listing of last logged in users
👁 11 views
📅 Updated: Mar 15, 2026
SYNTAX
last [OPTION]... [USERNAME]
What Does last Do?
last displays a list of recent user logins and system events by reading the /var/log/wtmp file. It shows login times, logout times, session duration, and the source IP or terminal.
last is essential for security auditing (who logged in and when), troubleshooting (when was the system rebooted), and compliance monitoring. It also shows system reboots and shutdowns.
last reads the binary wtmp file, which records all login/logout activity. The lastb command shows failed login attempts from /var/log/btmp.
last is essential for security auditing (who logged in and when), troubleshooting (when was the system rebooted), and compliance monitoring. It also shows system reboots and shutdowns.
last reads the binary wtmp file, which records all login/logout activity. The lastb command shows failed login attempts from /var/log/btmp.
Options & Flags
| Option | Description | Example |
|---|---|---|
| username | Show logins for specific user | last admin |
| -n N | Show only last N entries | last -n 10 |
| -a | Show hostname in last column | last -a |
| -i | Show IP addresses instead of hostnames | last -i |
| -x | Show system shutdown/runlevel changes | last -x |
| -d | Translate IPs to hostnames | last -d |
| -F | Show full login/logout times | last -F |
Practical Examples
#1 Show recent logins
Shows the 10 most recent login entries.
$ last -n 10
Output:
admin pts/0 192.168.1.50 Mon Jan 1 10:00 still logged in
jdoe pts/1 10.0.0.100 Mon Jan 1 09:30 - 10:15 (00:45)
#2 Show user logins
Shows all login history for the admin user.
$ last admin#3 Show reboots
Shows system reboot history.
$ last reboot
Output:
reboot system boot 5.15.0 Mon Jan 1 08:00 still running
#4 Show with IPs
Shows last 20 logins with IP addresses in the last column.
$ last -ai -n 20#5 Show shutdowns
Shows system shutdown events.
$ last -x shutdown#6 Failed logins
Shows last 10 failed login attempts.
$ sudo lastb -n 10Tips & Best Practices
Security monitoring: Run last -ai regularly to monitor login activity. Unexpected IPs or times may indicate unauthorized access.
lastb for failures: sudo lastb shows failed login attempts (from /var/log/btmp). Useful for detecting brute force attacks.
wtmp can be cleared: An attacker with root access can clear /var/log/wtmp. Use remote syslog and log monitoring for reliable auditing.
Frequently Asked Questions
How do I see login history?
Run last to see all recent logins. Use last username for a specific user. last -n 20 shows the last 20 entries.
How do I check when the system was rebooted?
Use last reboot to see all system reboots with timestamps.
How do I see failed login attempts?
Use sudo lastb. It reads /var/log/btmp which records failed authentication attempts.
Related Commands
More User Management Commands
Master Linux with Professional eBooks
Curated IT eBooks covering Linux, DevOps, Cloud, and more
Browse Books →