last Command

Purpose

Displays information about previous logins.

Syntax

last [ -X ] [ -f FileName ] [ -t Time ] [ -n Number | -Number ] [ Name ... ] [ Terminal ... ]

Description

The last command displays, in reverse chronological order, all previous logins and logoffs still recorded in the /var/adm/wtmp file. The /var/adm/wtmp file collects login and logout records as these events occur and holds them until the records are processed by the acctcon1 and acctcon2 commands as part of the daily reporting procedures. When the time daemon, timed, changes the system time, it logs entries in wtmp under the pseudo-user "date". An entry starting with "date |" is logged before the change, and one starting with "date {" is logged after the change. This allows for accurate accounting of logins that span a time change.

The list can be restricted to:

The number of lines specified either with the -Number parameter or with the -n flag.
Logins or logoffs by the users specified by the Name parameter.
Logins or logoffs from the terminals specified by the Terminal parameter.
A terminal can be named fully or abbreviated as a tty. For example, you can specify either the tty0 terminal or the 0 terminal.
Note: If you specify both a Name and Terminal parameter, the last command displays all logins and logoffs meeting either criterion.

For each process, the last command displays the:

Time the session began
Duration
Terminal (tty) used

If applicable, the following information is included:

Terminations due to rebooting
Sessions that are still continuing

If the last command is interrupted, it indicates how far the search has progressed in the /var/adm/wtmp file. If interrupted with a quit signal, the command indicates how far the search has progressed and then continues the search. The quit signal can be any one of the following:

#define SIGQUIT 3 /* (*) quit, 
generated from terminal special char */
   
#define SIGKILL 9 /* kill (cannot be caught or ignored) */
   
#define SIGTERM 15 /* software termination signal */

The kill command sends the default SIGTERM signal when it is invoked without any option. If you want to send the SIGQUIT signal, enter the following:

kill -3 (Process ID)

See the kill command for more information.

Flags

Item	Description
-f FileName	Specifies an alternate file from which to read logins and logoffs.
-n	Specifies the number of lines to be displayed on the list.
-t Time	Displays users logged in at the given Time value. The Time variable is specified in the decimal form [[CC]YY]MMDDhhmm[.SS] where: CC Specifies the first two digits of the year. YY Specifies the last two digits of the year. MM Specifies the month of the year (01 to 12). DD Specifies the day of the month (01 to 31). hh Specifies the hour of the day (00 to 23). mm Specifies the minute of the hour (00 to 59). SS Specifies the second of the minute (00 to 59).
-X	Prints all available characters of each user name instead of truncating to the first 8 characters.

Examples

To display all the recorded logins and logoffs by user root or from the console terminal, type:
```
last root console
```
To display the time between reboots of the system, type:
```
last reboot
```
The reboot pseudo-user logs in when the system starts again.
To display all the users still logged in at 10.30 am on April 15th, enter:
```
last -t 04151030
```
To display 10 lines in the list, type:
```
last -n 10
```
To display all the recorded logins and logoffs without truncating the user name, type:
```
last -X
```

Files

Item	Description
/usr/bin/last	Contains the last command.
/var/adm/wtmp	Contains connect-time accounting data, including login, logoff, and shutdown records.