Linux Terminal Command: last

The last command is an essential tool in User & Permission Management. In this tutorial, we will explore what last does, look at everyday examples, and cover advanced options to supercharge your command-line workflow.

Concept & Explanation

The last command reads the /var/log/wtmp file to list logins and logouts of users, including system boot events, starting from the most recent.

Common Options & Syntax

last [options] [arguments]

Here are the most common flags used with last:

Simple Usage: Basic default commands.
Detailed View: Shows diagnostic information.
Advanced Actions: Can chain parameters for scripting.

1. Interactive Example (Simple)

Here is how most people run the command:

# Example
last

What it does: Displays the history of recent user login events.

2. Power-User Example (Advanced)

For scripting and advanced diagnostics, use this configuration:

# Advanced
last -n 20 -F -i reboot

What it does: Lists the last 20 reboot events, showing full login/logout timestamps (-F) and the IP address instead of hostnames (-i).

⚙️ Warning & Common Pitfalls

[!WARNING] If /var/log/wtmp is rotated or cleared by system maintenance, older login records will be permanently lost.

Here are some related posts on cli_tty1 you might want to check out:

chmod : Change file mode bits (permissions).
chown : Change file owner and group.
chgrp : Change group ownership.