Go to the first, previous, next, last section, table of contents.


last looks through the wtmp file (which records all logins/logouts) and prints information about connect times of users. Records are printed from most recent to least recent. Records can be specified by tty and username. tty names can be abbreviated: `last 0' is equivalent to `last tty0'.

Multiple arguments can be specified: `last root console' will print all of the entries for the user root and all entries logged in on the console tty.

The special users reboot and shutdown log in when the system reboots or (surprise) shuts down. `last reboot' will produce a record of reboot times.

If last is interrupted by a quit signal, it prints out how far its search in the wtmp file had reached and then quits:

weerapan  ttyq6    Mon Feb 15 19:07 - 19:21  (00:13)
weerapan  ttyq6    Mon Feb 15 19:07 - 19:21  (00:13)

interrupted at Mon Feb 15 19:07:52 1993


This program implements the features of regular u*x last with a few extra flags. When last is invoked with no arguments, the output looks like this:

gr151     ttyp2    ray.cs.oberlin.e Tue Feb 16 17:40   still logged in
jhoggard  ttyp2    csts.cs.oberlin. Tue Feb 16 17:39 - 17:39  (00:00)
jstarr    ttyp1    UNIX5.ANDREW.CMU Tue Feb 16 17:38   still logged in
jberman   ttypb    Tue Feb 16 17:34   still logged in
alee      ttyp7    csts.cs.oberlin. Tue Feb 16 17:34   still logged in
jbrick    ttyp2    ocvaxa.cc.oberli Tue Feb 16 17:33 - 17:36  (00:03)
mbastedo  ttypc    ocvaxa.cc.oberli Tue Feb 16 17:25 - 17:26  (00:01)
rgoodste  ttypb    ocvaxa.cc.oberli Tue Feb 16 17:22 - 17:26  (00:03)
huttar    ttyp9    lobby.ti.com     Tue Feb 16 17:19   still logged in
klutz     ttyp3    Tue Feb 16 17:14   still logged in
When printing out the information, don't chop the number part off of ftpxxxx entries.
-n number
--lines number
Limit the number of lines that last prints.
-f filename
--file filename
Read from the file filename instead of the system's wtmp file.
Print out the year when displaying dates.
Print out seconds when displaying dates and durations.
When the wtmp file has a problem (a time-warp, missing record, or whatever), print out an appropriate error.
Print out run level changes, shutdowns, and time changes in addition to the normal records.
Print out all records in the wtmp file.
Some machines store the IP address of a connection in a utmp record. Enabling this option makes last print the IP address instead of the hostname.
--tw-leniency value
Set the time warp leniency value (in seconds). See the ac chapter for information.
--tw-suspicious value
Set the time warp suspicious value (in seconds). See the ac chapter for information.
Print verbose internal information.
Print last's version number.
Print last's usage string and default locations of system files to standard output.


The Clock Change Problem

Of the lasts I've tried, all of them have had problems parsing a system clock change. Instead of modifying the entries that have been read, they just ignore the change and give you incorrect values. GNU last knows about clock changes and prints the correct times.

TANGIBLE RESULT: if you diff the output of your last and GNU last, entries after (before, rather) a clock change will be off by the amount of the clock change.

The Ftp Problem

Most lasts that I've examined have the same problem here as ac does--they log everyone out as soon as they see an ftp entry.

TANGIBLE RESULT: GNU last will reflect the correct time spent in an ftp session, so the totals that it gives will most likely be greater than those given by the system last.

Go to the first, previous, next, last section, table of contents.