Skip to content
SoftPrayog
  • Home
  • Programming
  • Tutorials
  • Videos
  • Software Engineering
  • Troubleshooting

Find user login history – last and lastb commands in Linux

By Karunesh Johri   •   Updated: May 28, 2022

Login

1.0 last and lastb

The last command gives a chronological list of user logins in a Linux system for a period of time. The lastb commands gives a similar list of failed logins to the system. By default, last uses the /var/log/wtmp file for the record of login data. Similarly, lastb, by default, reads the /var/log/btmp file for the record of failed logins.

2.0 Command syntax

last [-R] [-num] [ -n num ] [-adFiowx] [ -f file ] [ -t YYYYMMDDHHMMSS ] [name...]  [tty...]
lastb [-R] [-num] [ -n num ] [ -f file ] [-adFiowx] [name...]  [tty...]

3.0 Examples

3.1 last

$ last
user1    pts/0        203.0.113.168    Tue May 17 10:26   still logged in
user1    ttyS0                         Tue May 17 10:19 - 10:20  (00:00)
user2    pts/1        198.51.100.12    Tue May 17 00:54 - 01:33  (00:38)
user3    pts/3        198.51.100.15    Mon May 16 10:13 - 17:54  (07:40)
user2    pts/7        198.51.100.11    Sun May 15 17:28 - 17:41  (00:13)
user1    pts/2        198.51.100.19    Sun May 15 15:08 - 15:19  (00:10)
user3    pts/0        198.51.100.17    Sat May 14 08:29 - 11:15  (02:45)
  ...
  ...
  ...
user1    ttyS0                         Sat May  7 03:51 - 03:53  (00:02)
reboot   system boot  4.5.0-x86_64-lin Sat May  7 03:50   still running

For each login, username, terminal, IP address, date and times of login and logout and the session time are printed. The line for pseudo-user reboot gives the time of system boot.

3.2 lastb

lastb gives the history of failed logins.

$ sudo lastb
admin    ssh:notty    203.0.113.252    Wed May  4 05:17 - 05:17  (00:00)
UNKNOWN  ttyS0                         Tue May  3 16:48 - 16:48  (00:00)

btmp begins Tue May  3 16:48:02 2016

3.3 last -f filename

With the -f option , we can use a different input file. The -R option suppresses the display of hostname.

$ last -R -f /var/log/wtmp.1
user1    :0           Fri Apr 29 05:46 - down   (00:20)
reboot   system boot  Fri Apr 29 05:46 - 06:07  (00:21)
guest-8S :1           Thu Apr 28 20:53 - 21:15  (00:21)
   ...

3.4 last -n num

The -n num option limits the output to the first num lines. We can skip -n and say last -num and get the same output.

3.5 last -F

The -F option is for the printing of full login and logout dates and times.

3.6 last -a

with the -a option, we get the hostname in the last column.

3.7 last -d

-d displays the hostname instead of its IP address. For example,

$ last -5  -F -a -d
user1    pts/0        Wed May 18 00:27:06 2016   still logged in                       arbt-equat-dynamic-198.51.100.19.expressbroadband.com
user1    ttyS0        Wed May 18 00:26:11 2016 - Wed May 18 00:26:42 2016  (00:00)     0.0.0.0
user1    pts/0        Tue May 17 17:12:26 2016 - Tue May 17 17:20:32 2016  (00:08)     arbt-equat-dynamic-198.51.100.19.expressbroadband.com
user1    ttyS0        Tue May 17 17:11:26 2016 - Tue May 17 17:11:57 2016  (00:00)     0.0.0.0
user1    pts/0        Tue May 17 10:26:14 2016 - Tue May 17 12:02:32 2016  (01:36)     arbt-equat-dynamic-198.51.100.19.expressbroadband.com

3.8 last -i

The -i option causes prining of user's IP address in numbers and dots notation.

3.9 last user

If a username is passed as a command line parameter, the login data for that user is printed.

$ last alice -5 -a -i
alice   pts/0        Wed May 18 06:54   still logged in    198.51.100.17
alice   pts/0        Wed May 18 00:27 - 01:00  (00:33)     203.0.113.168
alice   ttyS0        Wed May 18 00:26 - 00:26  (00:00)     0.0.0.0
alice   pts/0        Tue May 17 17:12 - 17:20  (00:08)     198.51.100.15
alice   ttyS0        Tue May 17 17:11 - 17:11  (00:00)     0.0.0.0
Tags: command, example, last, lastb, Linux, login, syntax, sysadmin, System administration, user
Post navigation
← Previous Post
Next Post →
Subscribe to SoftPrayog on YouTube
Related Posts
ps command
ps command usage with examples in Linux
htop
htop command in Linux
top
top Command in Linux
sar command in Linux
sar command in Linux
Load average
Load Average
About
Contact Us
Privacy Policy
Terms of service
Copyright © 2022 Karunesh Johri. All Rights Reserved.