Linux Command Learning Summary: last

Introduction to Commands:

This command is used to list information about users who have logged in to the system in the past. Directive English literal: Show listing of last logged in users

Execute permissions: Some require special permissions

Instruction Path:/usr/bin/last

When the last instruction is executed, it reads a file that is named Wtmp in the/var/log directory and displays all the user lists of the logged-on system to the file's content record. The default is to display Wtmp records, BTMP can display more detailed, can display remote logins, such as SSH login.

The utmp file holds information about the users currently in the system.

The wtmp file holds information about the user who has logged in to the system.

The command output field describes:

First column: User name

Second column: End position. pts/0 (pseudo terminal) means a remote connection from a user such as SSH or Telnet. TTY (teletypewriter) means a user connected directly to a computer or locally connected

Third column: Login IP or kernel. If you see: 0.0 or nothing, this means that the user is connected via a local terminal. In addition to restarting the activity, the kernel version is displayed in the status.

Fourth column: Start time

Fifth column: End time (still login in has not exited down until normal shutdown crash until shutdown is forced)

Sixth column: Duration

Command syntax:

Last [-R] [-num] [-N num] [-adiowx] [-f file] [-t YYYYMMDDHHMMSS] [name ...] [TTY ...]

Command parameters:

Parameters	Long parameters	Description
-A		The host name or IP address that will be logged into the system, displayed in the last line
-D		Convert IP address to host name
-F		Specifies the record file, the default is to display the records of the Wtmp file under the/var/log directory, but the/var/log directory has more content btmp to display, can display remote logins, such as SSH logins, including failed login requests.
-I.		-I displays the status of a specific IP login. Track the case of a specific IP login with-i display. Tracking with
-O		Read an old-type wtmp file (written by LINUX-LIBC5 applications).
-N		-N < Show columns > or-< Show columns > set the number of displayed columns for a list
-W		Display full user and domain names in the output
-R		Do not display the host name or IP of the login system (omit hostname fields)
-T		To display information before YYYYMMDDHHMMSS
-X		Shows the history of system shutdown, user login, and exit

Examples of Use:

1: View the Help information for last command

[[email protected] ~]# man

[Email protected] ~]# last-h

Last:invalid option--H

Usage:last [-num |-n num] [-f file] [-t YYYYMMDDHHMMSS] [-R] [-X] [-O] [-W] [username..] [TTY ...]

2: Display the last logged in System N records

[[Email protected] ~] #last-10

Wtmp begins Wed Dec 11 03:02:17 2013

[Email protected] ~]# Last-n 10

Wtmp begins Wed Dec 11 03:02:17 2013

3: Display the host name or IP address of the login system on the last line

[Email protected] ~]# last-10-a

Root PTS/1 Wed Dec 09:54 still logged in:0.0

Root PTS/4 Wed Dec 18 09:43-09:48 (00:04): 0.0

Root PTS/1 Wed Dec 18 09:43-09:48 (00:05): 0.0

Root PTS/3 Wed Dec 18 09:41-12:40 (02:59) 192.168.103.79

Root PTS/4 Wed Dec 18 09:28-09:30 (00:01): 0.0

Root PTS/3 Wed Dec 18 09:27-09:30 (00:02): 0.0

Root PTS/2 Wed Dec 09:27 still logged in 192.168.103.29

Root PTS/1 Wed Dec 18 09:27-09:42 (00:15): 0.0

Root PTS/2 Wed Dec 18 09:23-09:25 (00:01): 0.0

Root PTS/1 Wed Dec 18 09:22-09:25 (00:02): 0.0

Wtmp begins Wed Dec 11 03:02:17 2013

4: Do not display the host name or IP address of the login system

[Email protected] ~]# Last-10-r

Wtmp begins Wed Dec 11 03:02:17 2013

5: Specify the/var/log/btmp file to view information about users logged on to the system

[Email protected] ~]# last-n 10-f/var/log/btmp

Btmp begins Thu Apr 12 14:30:06 2012

6: Convert IP address to host name

Last-10-d

7: Show information before YYYYMMDDHHMMSS (20150110093000)

[Email protected] ~]# last-10-t 20150110093000

Wtmp begins Wed Apr 11 16:31:10 2012

Linux Command Learning Summary: last