Linux how to use the last command

last is a built-in tracking tool for Linux system, can list the relevant information of the login user, run through the input, do not need to install independently, the following small series will give you a detailed description of the use of the last command Introduce so that you have an understanding.

function last command is what

last show is from /var /log /wtmp file was created since all users log in (and out) of. This file is a binary file that cannot be viewed by a text editor such as vi, Joe or other software. This is very useful because the user (or root) cannot modify this file as they wish.

last gives the username, tty, IP address of all logged in users (if the user is a remote connection), date-time, and the time the user has logged in.

How to run last

Just type last in the console. Here is an example:

$ last

leni pts/0 10.0.76.162 Mon Dec 2 12:32 - 13:25 (00:53)

pungki tty1 Mon Dec 2 09:31 still logged in

reboot system boot 2.6.32-358.23.2 Mon Dec 2 09:20 - 13:25 (04:05)

Here's how to read last information :

The first column tells the user who is

The second column gives information on how the user is connected

pts/0 (pseudo-terminal) means from something like SSH or Telnet remote connection users

tty (teletypewriter) means direct connection to a computer or locally connected user

In addition to restarting activities, all statuses are displayed at startup

The third column shows where the user came from. If the user is from a remote computer, you will see a hostname or IP address. If you see: 0.0 or nothing, this means that the user is connected through the local terminal. In addition to the restart activity, the kernel version is displayed in the state.

The remaining columns show when the log activity occurred. The numbers in parentheses tell us how many hours and minutes the connection lasted.

Some examples of last in everyday operations

Limit the number of rows displayed

When you have a lot of lines to display, you can limit the number of rows you want to see. . Use the -n parameter to do this.

$ last -n 3

leni pts/0 10.0.76.162 Mon Dec 2 12:32 - 13:25 (00:53)

pungki tty1 Mon Dec 2 09:31 still logged in

reboot system boot 2.6.32-358.23.2 Mon Dec 2 09:20 - 13:25 (04:05)

-n parameter will make last display 3 records from the current time to the future.

Do not display hostnames

Use the -R parameter to do this. Here is an example:

$ last -R

leni pts/0 Mon Dec 2 12:32 - 13:25 (00:53)

pungki tty1 Mon Dec 2 09:31 still logged in

reboot system boot Mon Dec 2 09:20 - 13:25 (04:05)

As you can see, there is no host or IP address now. The information is gone.

The last column shows the hostname

To do this, we use the -a parameter

$ last -a

leni pts/0 Mon Dec 2 12 :32 - 13:25 (00:53) 10.0.76.162

pungki tty1 Mon Dec 2 09:31 still logged in :0.0

reboot system boot Mon Dec 2 09:20 - 13 :25 (04:05) 2.6.32-358.23.2.el6.i686

Now host information such as 10.0.76.162 will be placed in the last column.

Show full login logout date

For this, you can use the -F parameter. This is an example:

$ last -F

leni pts/0 10.0.76.162 Mon Dec 2 12:32:24 2013 – Mon Dec 2013 13:25:24 2013 (00: 53)

Printing a specific username

If you want to track a specific user, you can print it specifically. Enter the username after the last command.

$ last leni

leni tty1 Mon Dec 2 18-42 still logged in

leni pts/0 Mon Dec 2 12:32 - 13:25 (00:53 10.0.76.162

Or you want to know when the reboot is complete, you can also display it like this:

$ last reboot

reboot system boot Mon Dec 2 09: 20 - 16:55 (07:34)

reboot system boot Sun Dec 1 04:26 - 04:27 (00:01)

reboot system boot Wed Nov 27 20:27 - 01:24 (04:57)

reboot system boot Tue Nov 26 21:06 - 06:13 (09:06)

Print specific /pts

last same You can print information about a specific tty/pts. Just enter the tty name or pty name after the last command.
Previous12Next Total 2 Pages