//po4a: entry man manual
////
Copyright (C) 1998-2004 Miquel van Smoorenburg.

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
////
= last(1)
:doctype: manpage
:man manual: User Commands
:man source: util-linux {release-version}
:page-layout: base
:command: last

== NAME

last, lastb - show a listing of last logged in users

== SYNOPSIS

*last* [options] [_username_...] [_tty_...]

*lastb* [options] [_username_...] [_tty_...]

== DESCRIPTION

*last* searches back through the _/var/log/wtmp_ file (or the file designated by the *-f* option) and displays a list of all users logged in (and out) since that file was created. One or more _usernames_ and/or _ttys_ can be given, in which case *last* will show only the entries matching those arguments. Names of _ttys_ can be abbreviated, thus *last 0* is the same as *last tty0*.

When catching a *SIGINT* signal (generated by the interrupt key, usually control-C) or a *SIGQUIT* signal, *last* will show how far it has searched through the file; in the case of the *SIGINT* signal *last* will then terminate.

The pseudo user *reboot* logs in each time the system is rebooted. Thus *last reboot* will show a log of all the reboots since the log file was created.

*lastb* is the same as *last*, except that by default it shows a log of the _/var/log/btmp_ file, which contains all the bad login attempts.

== OPTIONS

*-a*, *--hostlast*::
Display the hostname in the last column. Useful in combination with the *--dns* option.

*-d*, *--dns*::
For non-local logins, Linux stores not only the host name of the remote host, but its IP number as well. This option translates the IP number back into a hostname.

*-f*, *--file* _file_::
Tell *last* to use a specific _file_ instead of _/var/log/wtmp_. The *--file* option can be given multiple times, and all of the specified files will be processed.

*-F*, *--fulltimes*::
Print full login and logout times and dates.

*-i*, *--ip*::
Like *--dns ,* but displays the host's IP number instead of the name.

**-**__number__; *-n*, *--limit* _number_::
Tell *last* how many lines to show.

*-p*, *--present* _time_::
Display the users who were present at the specified time. This is like using the options *--since* and *--until* together with the same _time_.

*-R*, *--nohostname*::
Suppresses the display of the hostname field.

*-s*, *--since* _time_::
Display the state of logins since the specified _time_. This is useful, e.g., to easily determine who was logged in at a particular time. The option is often combined with *--until*.

*-t*, *--until* _time_::
Display the state of logins until the specified _time_.

*--time-format* _format_::
Define the output timestamp _format_ to be one of _notime_, _short_, _full_, or _iso_. The _notime_ variant will not print any timestamps at all, _short_ is the default, and _full_ is the same as the *--fulltimes* option. The _iso_ variant will display the timestamp in ISO-8601 format. The ISO format contains timezone information, making it preferable when printouts are investigated outside of the system.

*-w*, *--fullnames*::
Display full user names and domain names in the output.

*-x*, *--system*::
Display the system shutdown entries and run level changes.

include::man-common/help-version.adoc[]

== TIME FORMATS

The options that take the _time_ argument understand the following formats:

[cols=",",]
|===
|YYYYMMDDhhmmss |
|YYYY-MM-DD hh:mm:ss |
|YYYY-MM-DD hh:mm |(seconds will be set to 00)
|YYYY-MM-DD |(time will be set to 00:00:00)
|hh:mm:ss |(date will be set to today)
|hh:mm |(date will be set to today, seconds to 00)
|now |
|yesterday |(time is set to 00:00:00)
|today |(time is set to 00:00:00)
|tomorrow |(time is set to 00:00:00)
|+5min |
|-5days |
|===

== FILES

_/var/log/wtmp_,
_/var/log/btmp_

== NOTES

The files _wtmp_ and _btmp_ might not be found. The system only logs information in these files if they are present. This is a local configuration issue. If you want the files to be used, they can be created with a simple *touch*(1) command (for example, *touch /var/log/wtmp*).

An empty entry is a valid type of wtmp entry. It means that an empty file or file with zeros is not interpreted as an error.

== AUTHORS

mailto:miquels@cistron.nl[Miquel van Smoorenburg]

== SEE ALSO

*login*(1),
*wtmp*(5),
*init*(8),
*shutdown*(8)

include::man-common/bugreports.adoc[]

include::man-common/footer.adoc[]

ifdef::translation[]
include::man-common/translation.adoc[]
endif::[]