In Linux, the/var/log/wtmp file method/var/log/wtmp file function/var/log/wtmp is also a binary file, records the logon times and duration of each user. This log file permanently records the logon, logout, and system startup and shutdown events of each user. Therefore, as the system runs normally, the file size increases, depending on the number of system user logins. This log file can be used to view the user's logon records. The last command obtains this information by accessing this file and displays the user's logon records in reverse order, last can also display corresponding records based on the user, terminal tty or time. View method: You can use the last command to output the following content: debian: /var/log # lastdebian pts/9 221.215.176.148 Thu Oct 17 still logged in debian pts/8 running Thu Oct 17 still logged in debian pts/7 running Thu Oct 17-) root pts/5 114.20.31.253 Thu Oct 17-() root pts/4 114.20.31.253 Thu Oct 17 ).... or use the last-f/var/log/wtmp last command: Function Description: lists the current and past logon systems. User-related information. Syntax: last [-adRx] [-f] [-n] [account name...] [terminal number...] note: Execute the last command separately. It will read the file named wtmp in the/var/log directory, and display all the usernames of the login system recorded in the file. Parameter:-a displays the host name or IP address from which to log on to the system in the last row. -D. Convert the IP address to the host name. -F specifies the record file. -N or-set the number of columns displayed in the list. -R does not display the host name or IP address used to log on to the system. -X displays information such as system shutdown, reboot, and change of execution level.