Linux last Command – List Users Who Logged In

When you need to check login details, what comes to mind first? Many would suggest “/var/log/secure” because it stores login history. But that is cumbersome: the log contains so much information that you need grep to find what you want. This article shows an easier way. Run the single command “last” and the login and reboot history appears immediately. The “last” command makes life easier by showing login history with timestamps, plus reboot history. All the data it displays is stored in “/var/log/wtmp”. If running “last” produces no information, check whether that file exists. Users other than root can also run this command. In addition to “last” for login history, Linux has “lastb” for bad login attempts. Its data is stored in “/var/log/btmp”. Examples of “last” and “lastb”: Show users who logged in and system reboot history:

[root@ezylinux ~]# last
root     pts/1        192.168.1.103    Tue Aug 16 08:25   still logged in
tum      pts/0        :0.0             Tue Aug 16 08:22 - 08:26  (00:03)
tum      tty1         :0               Sun Aug 14 08:49 - down   (02:27)
reboot   system boot  2.6.32-71.el6.x8 Sun Aug 14 08:47 - 11:16  (02:29)
root      pts/0        :0.0             Sat Jul 30 04:06 - down   (02:40)
tum      tty1         :0               Sat Jul 30 04:05 - down   (02:41)
tum      tty1         :0               Tue Jul  5 09:49 - 10:25  (00:35)
reboot   system boot  2.6.32-71.el6.x8 Tue Jul  5 09:49 - 10:25  (00:36)
tum      pts/0        :0.0             Tue Jul  5 04:27 - 04:30  (00:03)
root      tty1         :0               Mon Jul  4 21:47 - down   (06:43)
tum      tty1         :0               Sat Apr  2 00:05 - 00:14  (00:09)
tum      pts/0        :0.0             Tue Mar 22 09:18 - 09:19  (00:00)
tum      tty7         :0               Tue Mar 22 09:17 - 09:19  (00:01)
reboot   system boot  2.6.32-71.el6.x8 Tue Mar 22 16:13 - 09:19  (-6:-53)

wtmp begins Tue Mar 22 16:13:25 2011

Show only logins by root:

[root@localhost ~]# last root
root     pts/1        192.168.1.103    Tue Aug 16 08:25   still logged in
root     pts/1        192.168.79.1     Sat Jun 11 08:34 - 10:20  (01:46)

wtmp begins Tue Mar 22 16:13:25 2011

Show only system reboot history:

[root@localhost ~]# last reboot
reboot   system boot  2.6.32-71.el6.x8 Sun Aug 14 08:47 - 11:16  (02:29)
reboot   system boot  2.6.32-71.el6.x8 Sat Jul 30 03:49 - 06:47  (02:57)
reboot   system boot  2.6.32-71.el6.x8 Sat Jun 11 07:07 - 10:37  (03:29)
reboot   system boot  2.6.32-71.el6.x8 Sat Apr  2 00:03 - 00:14  (00:11)
reboot   system boot  2.6.32-71.el6.x8 Tue Mar 22 09:32 - 00:14 (10+14:42)
reboot   system boot  2.6.32-71.el6.x8 Tue Mar 22 16:13 - 09:19  (-6:-53)

wtmp begins Tue Mar 22 16:13:25 2011

Show users who attempted to log in:

[root@ezylinux ~]# lastb
tum      tty7         :0               Tue Aug 16 08:26 - 08:26  (00:00)
tum      tty7         :0               Tue Aug 16 08:26 - 08:26  (00:00)
root      ssh:notty    192.168.1.10    Tue Aug 16 08:25 - 08:25  (00:00)
tum      ssh:notty    192.168.1.3    Tue Aug 16 08:25 - 08:25  (00:00)
root      ssh:notty    192.168.1.55    Tue Aug 16 08:25 - 08:25  (00:00)
tum      ssh:notty    192.168.1.101    Tue Aug 16 08:25 - 08:25  (00:00)

btmp begins Tue Aug 16 08:25:42 2011

For more information, use:

[root@ezylinux ~]# man last

More information: Linux last command - Show listing of last logged in users