.\" Copyright (C) 1998-2004 Miquel van Smoorenburg.
.\"
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation; either version 2 of the License, or
.\" (at your option) any later version.
.\"
.\" This program is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program; if not, write to the Free Software
.\" Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
.\"
.TH "LAST,LASTB" "1" "August 2013" "util-linux" "User Commands"
.SH NAME
last, lastb \- show listing of last logged in users
.SH SYNOPSIS
.B last
.RI [ options ]
.RI [ username ...]
.RI [ tty ...]
.br
.B lastb
.RI [ options ]
.RI [ username ...]
.RI [ tty ...]
.SH DESCRIPTION
.B last
searches back through the file
.B /var/log/wtmp
(or the file designated by the
.B \-f
option) and displays a list of all users logged in (and out) since that
file was created.  One or more
.IR usernames " and/or " ttys
can be given, in which case
.B last
will show only the entries matching those arguments.  Names of
.I ttys
can be abbreviated, thus
.B last 0
is the same as
.BR "last tty0" .
.PP
When catching a \s-2SIGINT\s0 signal (generated by the interrupt key, usually
control-C) or a \s-2SIGQUIT\s0 signal,
.B last
will show how far it has searched through the file; in the case of the
\s-2SIGINT\s0 signal
.B last
will then terminate.
.PP
The pseudo user
.B reboot
logs in each time the system is rebooted.  Thus
.B last reboot
will show a log of all reboots since the log file was created.
.PP
.B lastb
is the same as
.BR last ,
except that by default it shows a log of the file
.BR /var/log/btmp ,
which contains all the bad login attempts.
.SH OPTIONS
.TP
\fB\-f\fR, \fB\-\-file\fR \fIfile\fR
Tell
.B last
to use a specific \fIfile\fR instead of
.BR /var/log/wtmp .
The
.B \-\-file
option can be given multiple times, and all of the specified files will be
processed.
.TP
\fB\-\fInumber\fR
.TQ
\fB\-n\fR, \fB\-\-limit\fR \fInumber\fR
This is a count telling
.B last
how many lines to show.
.TP
\fB\-s\fR, \fB\-\-since\fR \fItime\fR
Display the state of logins since specified
.IR time .
This is useful, e.g., to determine easily who was logged in at a
particular time.  The option is often combined with
.BR \-\-until .
.TP
\fB\-t\fR, \fB\-\-until\fR \fItime\fR
Display the state of logins until the specified
.IR time .
.TP
\fB\-p\fR, \fB\-\-present\fR \fItime\fR
Display the users who were present at the specified time.  This is
like using the options
.BR \-\-since " and " \-\-until
together with the same \fItime\fR.
.TP
\fB\-\-time\-format\fR \fIformat\fR
Define output timestamp
.I format
to be one of the
.IR notime ,
.IR short ,
.IR full ,
or
.IR iso .
.I notime
will not print timestamp at all.
.I short
is default, and
.I full
is same as
.B \-\-fulltimes
option.  The
.I iso
will display time stamp in ISO-8601 format.  The iso format contains
timezone information making it to be preferrable when print outs are
investigated outside of the system.
.TP
\fB\-F\fR, \fB\-\-fulltimes\fR
Print full login and logout times and dates.
.TP
\fB\-R\fR, \fB\-\-nohostname\fR
Suppresses the display of the hostname field.
.TP
\fB\-a\fR, \fB\-\-hostlast\fR
Display the hostname in the last column.  Useful in combination with the
.B \-\-dns
option.
.TP
\fB\-d\fR, \fB\-\-dns\fR
For non-local logins, Linux stores not only the host name of the remote
host but its IP number as well.  This option translates the IP number
back into a hostname.
.TP
\fB\-i\fR, \fB\-\-ip\fR
This option is like
.B \-\-dns
in that it displays the remote host, but it displays the host in IP
number notation.
.TP
\fB\-w\fR, \fB\-\-fullnames\fR
Display full user and domain names in the output.
.TP
\fB\-x\fR, \fB\-\-system\fR
Display the system shutdown entries and run level changes.
.SH TIME FORMATS
The options that take the
.I time
argument understand the following formats:
.TS
left l2 l.
YYYYMMDDhhmmss
YYYY-MM-DD hh:mm:ss
YYYY-MM-DD hh:mm	(seconds will be set to 00)
YYYY-MM-DD	(time will be set to 00:00:00)
hh:mm:ss	(date will be set to today)
hh:mm	(date will be set to today, seconds to 00)
now
yesterday	(time is set to 00:00:00)
today	(time is set to 00:00:00)
tomorrow	(time is set to 00:00:00)
+5min
-5days
.TE
.SH NOTES
The files
.I wtmp
and
.I btmp
might not be found.  The system only logs information in these files if
they are present.  This is a local configuration issue.  If you want the
files to be used, they can be created with a simple
.BR touch (1)
command (for example,
.IR "touch /var/log/wtmp" ).
.SH FILES
/var/log/wtmp
.br
/var/log/btmp
.SH AUTHOR
.MT miquels@cistron.nl
Miquel van Smoorenburg
.ME
.SH AVAILABILITY
The last command is part of the util-linux package and is available from
.UR ftp://\:ftp.kernel.org\:/pub\:/linux\:/utils\:/util-linux/
Linux Kernel Archive
.UE .
.SH "SEE ALSO"
.BR shutdown (8),
.BR login (1),
.BR init (8)