last

Updated

July 31, 2026

Overview

last reads the login wtmp database and shows recent logins, reboots, and shutdowns — useful for security reviews and “when did this box reboot?”.

Syntax

last [options] [username...] [tty...]

Common Options

Option Description
-n NUM / -NUM Show NUM lines
-a Display hostname in last column
-x Include shutdown/runlevel entries
-F Full timestamps
-i Numeric IPs
reboot As argument: show reboot lines only (common usage: last reboot)

Key Use Cases

  1. Audit recent logins
  2. See reboot history
  3. Investigate suspicious sessions
  4. Correlate with auth logs

Examples with Explanations

Recent logins

last -n 20

Latest sessions including still-logged-in.

Reboot history

last reboot | head

Quick uptime/reboot timeline.

One user

last -a alice

Focus on a single account; -a shows host origin.

Full time format

last -F -n 10

Easier correlation with log timestamps.

Notes & Pitfalls

  • Data comes from /var/log/wtmp (binary); rotation policies affect depth of history.