Command library / last

Show the login history for this host

Reads /var/log/wtmp and prints who logged in, from where, and when — including still-active sessions. Give it a username to see only that account's history, which is one of the fastest ways to check whether an account was used when it shouldn't have been.

Usage

Options and flags

• username

  show only this account's login history

• -n N

  show only the last N entries

• -a

  print the hostname in the last column, for easier reading

Examples

• last

  The full recent login history for every account.

• last -n 10

  Just the 10 most recent logins — a quick glance.

• last root

  Every time the root account has logged in — worth checking after any suspected compromise.

Common mistakes

Related commands