last — Login history

Linux / server log recording and analysis / last.html

Shows past login and logout records, most recent first.

Basic Information

What is this command?

last prints login and logout events from /var/log/wtmp, newest first, including user, terminal, source, start and end time, and duration.

Failed attempts are recorded separately and shown by lastb. Because wtmp rotates and newer systems may use wtmpdb, long-term auditing needs a separate pipeline.

What problems does it solve?

• Reviewing who logged in and when
• Tracing remote logins at unusual hours
• Correlating reboots with session end times
• Finding which account was active before an incident

Key features

Recent history

The default run lists recent logins in reverse order.

• When to use: Reviewing recent access patterns
• What you get: Session durations are included.
• Limitations: Output is empty when wtmp is empty.

Per-user lookup

Passing a user name restricts output to that account.

• When to use: Reviewing one account's history
• What you get: Narrows the audit to one account.
• Limitations: Deleted accounts may appear as UIDs.

Failed attempts

lastb shows failed logins from btmp.

• When to use: Checking for brute-force attempts
• What you get: You can see failing sources and counts.
• Limitations: btmp is normally readable only by root.

Installation and usage

Check whether it is installed

last --version

sudo apt install util-linux # Debian/Ubuntu sudo dnf install util-linux # Fedora

Real-world examples

Recent logins

Show recent session records.

last | head -n 20

Specific user

Filter to a single account.

last alice | head -n 20

Failed logins

Inspect failed attempts (root required).

sudo lastb | head -n 20