Usage of the last command in Linux

Usage of the last command in Linux

1. Role
In Linux, the last command is used to display the logon status of recent users or terminals. Its permission is granted to all users. Run the last command to view the log of the program. The administrator can find out who has tried or attempted to connect to the system.

2. Format

Last [-R] [-n] [-f file] [-t tty] [-h node] [-I-IP] [-1] [-y] [ID]

3. Main Parameters

-R: The field of hostname is omitted.

-N: Number of output records.

-F file: specifies that the file is used as the log file for query.

-T tty: only the logon status on the specified virtual console is displayed.

-H node: only the logon status on the specified node is displayed.

-I IP: only the logon status on the specified IP address is displayed.

-1: use an IP address to display the remote address.

-Y: displays the year, month, and day of the record.

-ID: the user name to be queried.

-X: displays the system shutdown, user logon, and logout history.

Example:
Shell> last-R-2
User3 pts/1 Mon Aug 14 20:42 still logged in
User3 pts/0 Mon Aug 14 :59 still logged in
Wtmp begins Tue Aug 1 19:01:10 2007 ###/var/log/wtmp

Shell> last-2 user1
User1 pts/0 140.119.217.115 Mon Aug 14)
User1 pts/0 140.119.217.115 Mon Aug 14)
Wtmp begins Tue Aug 1 19:01:10 2007

Linux built-in audit tracking tool-last command

Getting started with Linux: last Command in Linux

This article permanently updates the link address: