-.TH LAST 1 "20 March 1992"
+.\" Copyright (C) 1998-2004 Miquel van Smoorenburg.
+.\"
+.\" This program is free software; you can redistribute it and/or modify
+.\" it under the terms of the GNU General Public License as published by
+.\" the Free Software Foundation; either version 2 of the License, or
+.\" (at your option) any later version.
+.\"
+.\" This program is distributed in the hope that it will be useful,
+.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+.\" GNU General Public License for more details.
+.\"
+.\" You should have received a copy of the GNU General Public License
+.\" along with this program; if not, write to the Free Software
+.\" Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+.\"
+.TH "LAST, LASTB" "1" "October 2013" "util-linux" "User Commands"
.SH NAME
-last \(em indicate last logins by user or terminal
+last, lastb \- show a listing of last logged in users
.SH SYNOPSIS
-.ad l
.B last
-.RB [ \-\fP\fInumber\fP ]
-.RB [ \-f
-.IR filename ]
-.RB [ \-t
-.IR tty ]
-.RB [ \-h
-.IR hostname ]
-.RB [ \-i
-.IR address ]
-.RB [ \-l ]
-.RB [ \-y ]
-.RI [ name ...]
-.ad b
+[options]
+.RI [ username "...] [" tty ...]
+.br
+.B lastb
+[options]
+.RI [ username "...] [" tty ...]
.SH DESCRIPTION
-\fBLast\fP looks back in the \fBwtmp\fP file which records all logins
-and logouts for information about a user, a teletype or any group of
-users and teletypes. Arguments specify names of users or teletypes of
-interest. If multiple arguments are given, the information which
-applies to any of the arguments is printed. For example ``\fBlast root
-console\fP'' would list all of root's sessions as well as all sessions
-on the console terminal. \fBLast\fP displays the sessions of the
-specified users and teletypes, most recent first, indicating the times
-at which the session began, the duration of the session, and the
-teletype which the session took place on. If the session is still
-continuing or was cut short by a reboot, \fBlast\fP so indicates.
-.LP
-The pseudo-user \fBreboot\fP logs in at reboots of the system.
-.LP
-\fBLast\fP with no arguments displays a record of all logins and
-logouts, in reverse order.
-.LP
-If \fBlast\fP is interrupted, it indicates how far the search has
-progressed in \fBwtmp\fP. If interrupted with a quit signal \fBlast\fP
-indicates how far the search has progressed so far, and the search
-continues.
+.B last
+searches back through the
+.I /var/log/wtmp
+file (or the file designated by the
+.B \-f
+option) and displays a list of all users logged in (and out) since that
+file was created. One or more
+.IR usernames " and/or " ttys
+can be given, in which case
+.B last
+will show only the entries matching those arguments. Names of
+.I ttys
+can be abbreviated, thus
+.B last 0
+is the same as
+.BR "last tty0" .
+.PP
+When catching a SIGINT signal (generated by the interrupt key, usually
+control-C) or a SIGQUIT signal,
+.B last
+will show how far it has searched through the file; in the case of the
+SIGINT signal
+.B last
+will then terminate.
+.PP
+The pseudo user
+.B reboot
+logs in each time the system is rebooted. Thus
+.B last reboot
+will show a log of all the reboots since the log file was created.
+.PP
+.B lastb
+is the same as
+.BR last ,
+except that by default it shows a log of the
+.I /var/log/btmp
+file, which contains all the bad login attempts.
.SH OPTIONS
-.IP \fB\-\fP\fInumber\fP
-limit the number of entries displayed to that specified by \fInumber\fP.
-.IP "\fB\-f\fP \fIfilename\fP"
-Use \fIfilename\fP as the name of the accounting file instead of
-.BR /var/log/wtmp .
-.IP "\fB\-h\fP \fIhostname\fP"
-List only logins from \fIhostname\fP.
-.IP "\fB\-i\fP \fIIP address\fP""
-List only logins from \fIIP address\fP.
-.IP "\fB\-l\fP"
-List IP addresses of remote hosts instead of truncated host names.
-.IP "\fB\-t\fP \fItty\fP"
-List only logins on \fItty\fP.
-.IP "\fB\-y\fP"
-Also report year of dates.
+.TP
+.BR \-a , " \-\-hostlast"
+Display the hostname in the last column. Useful in combination with the
+.B \-\-dns
+option.
+.TP
+.BR \-d , " \-\-dns"
+For non-local logins, Linux stores not only the host name of the remote
+host, but its IP number as well. This option translates the IP number
+back into a hostname.
+.TP
+.BR \-f , " \-\-file " \fIfile\fR
+Tell
+.B last
+to use a specific \fIfile\fR instead of
+.IR /var/log/wtmp .
+The
+.B \-\-file
+option can be given multiple times, and all of the specified files will be
+processed.
+.TP
+.BR \-F , " \-\-fulltimes"
+Print full login and logout times and dates.
+.TP
+.BR \-i , " \-\-ip"
+Like
+.B \-\-dns ,
+but displays the host's IP number instead of the name.
+.TP
+.BI \- number
+.TQ
+.BR \-n , " -\-limit " \fInumber\fR
+Tell
+.B last
+how many lines to show.
+.TP
+.BR \-p , " \-\-present " \fItime\fR
+Display the users who were present at the specified time. This is
+like using the options
+.BR \-\-since " and " \-\-until
+together with the same \fItime\fR.
+.TP
+.BR \-R , " \-\-nohostname"
+Suppresses the display of the hostname field.
+.TP
+.BR \-s , " \-\-since " \fItime\fR
+Display the state of logins since the specified
+.IR time .
+This is useful, e.g., to easily determine who was logged in at a
+particular time. The option is often combined with
+.BR \-\-until .
+.TP
+.BR \-t , " \-\-until " \fItime\fR
+Display the state of logins until the specified
+.IR time .
+.TP
+.BI \-\-time\-format " format"
+Define the output timestamp
+.I format
+to be one of
+.IR notime ,
+.IR short ,
+.IR full ,
+or
+.IR iso .
+The
+.I notime
+variant will not print any timestamps at all,
+.I short
+is the default, and
+.I full
+is the same as the
+.B \-\-fulltimes
+option. The
+.I iso
+variant will display the timestamp in ISO-8601 format. The ISO format
+contains timezone information, making it preferable when printouts are
+investigated outside of the system.
+.TP
+.BR \-w , " \-\-fullnames"
+Display full user names and domain names in the output.
+.TP
+.BR \-x , " \-\-system"
+Display the system shutdown entries and run level changes.
+.SH TIME FORMATS
+The options that take the
+.I time
+argument understand the following formats:
+.TS
+l2 l.
+YYYYMMDDhhmmss
+YYYY-MM-DD hh:mm:ss
+YYYY-MM-DD hh:mm (seconds will be set to 00)
+YYYY-MM-DD (time will be set to 00:00:00)
+hh:mm:ss (date will be set to today)
+hh:mm (date will be set to today, seconds to 00)
+now
+yesterday (time is set to 00:00:00)
+today (time is set to 00:00:00)
+tomorrow (time is set to 00:00:00)
++5min
+-5days
+.TE
+.SH NOTES
+The files
+.I wtmp
+and
+.I btmp
+might not be found. The system only logs information in these files if
+they are present. This is a local configuration issue. If you want the
+files to be used, they can be created with a simple
+.BR touch (1)
+command (for example,
+.IR "touch /var/log/wtmp" ).
.SH FILES
-/var/log/wtmp \(em login data base
+/var/log/wtmp
+.br
+/var/log/btmp
+.SH AUTHOR
+.MT miquels@cistron.nl
+Miquel van Smoorenburg
+.ME
.SH AVAILABILITY
-The last command is part of the util-linux-ng package and is available from
-ftp://ftp.kernel.org/pub/linux/utils/util-linux-ng/.
+The last command is part of the util-linux package and is available from
+.UR https://\:www.kernel.org\:/pub\:/linux\:/utils\:/util-linux/
+Linux Kernel Archive
+.UE .
+.SH "SEE ALSO"
+.BR login (1),
+.BR wtmp (5),
+.BR init (8),
+.BR shutdown (8)
projects / thirdparty / util-linux.git / blobdiff