.\" along with this program; if not, write to the Free Software
.\" Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
.\"
-.TH "LAST,LASTB" "1" "August 2013" "util-linux" "User Commands"
+.TH "LAST, LASTB" "1" "October 2013" "util-linux" "User Commands"
.SH NAME
-last, lastb \- show listing of last logged in users
+last, lastb \- show a listing of last logged in users
.SH SYNOPSIS
.B last
-.RI [ options ]
-.RI [ username... ]
-.RI [ tty... ]
+[options]
+.RI [ username "...] [" tty ...]
.br
.B lastb
-.RI [ options ]
-.RI [ username... ]
-.RI [ tty... ]
+[options]
+.RI [ username "...] [" tty ...]
.SH DESCRIPTION
.B last
-searches back through the file
-.B /var/log/wtmp
-(or the file designated by the
+searches back through the
+.I /var/log/wtmp
+file (or the file designated by the
.B \-f
option) and displays a list of all users logged in (and out) since that
-file was created.
-.I Names
-of users and
-.IR tty 's
+file was created. One or more
+.IR usernames " and/or " ttys
can be given, in which case
.B last
-will show only those entries matching the arguments. Names of
+will show only the entries matching those arguments. Names of
.I ttys
can be abbreviated, thus
.B last 0
is the same as
.BR "last tty0" .
.PP
-When
-.B last
-catches a \s-2SIGINT\s0 signal (generated by the interrupt key, usually
-control-C) or a \s-2SIGQUIT\s0 signal,
+When catching a SIGINT signal (generated by the interrupt key, usually
+control-C) or a SIGQUIT signal,
.B last
will show how far it has searched through the file; in the case of the
-\s-2SIGINT\s0 signal
+SIGINT signal
.B last
will then terminate.
.PP
.B reboot
logs in each time the system is rebooted. Thus
.B last reboot
-will show a log of all reboots since the log file was created.
+will show a log of all the reboots since the log file was created.
.PP
.B lastb
is the same as
.BR last ,
-except that by default it shows a log of the file
-.BR /var/log/btmp ,
-which contains all the bad login attempts.
+except that by default it shows a log of the
+.I /var/log/btmp
+file, which contains all the bad login attempts.
.SH OPTIONS
.TP
-\fB\-f\fR, \fB\-\-file\fR \fIfile\fR
+.BR \-a , " \-\-hostlast"
+Display the hostname in the last column. Useful in combination with the
+.B \-\-dns
+option.
+.TP
+.BR \-d , " \-\-dns"
+For non-local logins, Linux stores not only the host name of the remote
+host, but its IP number as well. This option translates the IP number
+back into a hostname.
+.TP
+.BR \-f , " \-\-file " \fIfile\fR
Tell
.B last
-to use a specific file instead of
-.BR /var/log/wtmp .
+to use a specific \fIfile\fR instead of
+.IR /var/log/wtmp .
The
-.BI \-\-file " file"
-can be specified multiple times, and all of the defined files will be
+.B \-\-file
+option can be given multiple times, and all of the specified files will be
processed.
.TP
-\fB\-\fInumber\fR
+.BR \-F , " \-\-fulltimes"
+Print full login and logout times and dates.
+.TP
+.BR \-i , " \-\-ip"
+Like
+.B \-\-dns ,
+but displays the host's IP number instead of the name.
+.TP
+.BI \- number
.TQ
-\fB\-n\fR, \fB\-\-limit\fR \fInumber\fR
-This is a count telling
+.BR \-n , " -\-limit " \fInumber\fR
+Tell
.B last
how many lines to show.
.TP
-\fB\-t\fR, \fB\-\-until\fR \fIYYYYMMDDHHMMSS\fR
-Display the state of logins as of the specified time. This is useful,
-e.g., to determine easily who was logged in at a particular time --
-specify that time with
-.B \-\-until
-and look for "still logged in".
+.BR \-p , " \-\-present " \fItime\fR
+Display the users who were present at the specified time. This is
+like using the options
+.BR \-\-since " and " \-\-until
+together with the same \fItime\fR.
.TP
-\fB\-p\fR, \fB\-\-present\fR \fIYYYYMMDDHHMMSS\fR
-Display users who were present at the specified time. This option is
-similar with
-.BR \-\-until ,
-without printing any other lines than the matching sessions.
-.TP
-\fB\-F\fR, \fB\-\-fulltimes\fR
-Print full login and logout times and dates.
-.TP
-\fB\-R\fR, \fB\-\-nohostname\fR
+.BR \-R , " \-\-nohostname"
Suppresses the display of the hostname field.
.TP
-\fB\-a\fR, \fB\-\-hostlast\fR
-Display the hostname in the last column. Useful in combination with the
-.B \-\-dns
-option.
-.TP
-\fB\-d\fR, \fB\-\-dns\fR
-For non-local logins, Linux stores not only the host name of the remote
-host but its IP number as well. This option translates the IP number
-back into a hostname.
+.BR \-s , " \-\-since " \fItime\fR
+Display the state of logins since the specified
+.IR time .
+This is useful, e.g., to easily determine who was logged in at a
+particular time. The option is often combined with
+.BR \-\-until .
.TP
-\fB\-F\fR, \fB\-\-fullnames\fR
-Print full login and logout times and dates.
+.BR \-t , " \-\-until " \fItime\fR
+Display the state of logins until the specified
+.IR time .
.TP
-\fB\-i\fR, \fB\-\-ip\fR
-This option is like
-.B \-\-dns
-in that it displays the remote host, but it displays the host in IP
-number notation.
+.BI \-\-time\-format " format"
+Define the output timestamp
+.I format
+to be one of
+.IR notime ,
+.IR short ,
+.IR full ,
+or
+.IR iso .
+The
+.I notime
+variant will not print any timestamps at all,
+.I short
+is the default, and
+.I full
+is the same as the
+.B \-\-fulltimes
+option. The
+.I iso
+variant will display the timestamp in ISO-8601 format. The ISO format
+contains timezone information, making it preferable when printouts are
+investigated outside of the system.
.TP
-\fB\-w\fR, \fB\-\-fullnames\fR
-Display full user and domain names in the output.
+.BR \-w , " \-\-fullnames"
+Display full user names and domain names in the output.
.TP
-\fB\-x\fR, \fB\-\-system\fR
+.BR \-x , " \-\-system"
Display the system shutdown entries and run level changes.
+.SH TIME FORMATS
+The options that take the
+.I time
+argument understand the following formats:
+.TS
+l2 l.
+YYYYMMDDhhmmss
+YYYY-MM-DD hh:mm:ss
+YYYY-MM-DD hh:mm (seconds will be set to 00)
+YYYY-MM-DD (time will be set to 00:00:00)
+hh:mm:ss (date will be set to today)
+hh:mm (date will be set to today, seconds to 00)
+now
+yesterday (time is set to 00:00:00)
+today (time is set to 00:00:00)
+tomorrow (time is set to 00:00:00)
++5min
+-5days
+.TE
.SH NOTES
The files
.I wtmp
.ME
.SH AVAILABILITY
The last command is part of the util-linux package and is available from
-.UR ftp://\:ftp.kernel.org\:/pub\:/linux\:/utils\:/util-linux/
+.UR https://\:www.kernel.org\:/pub\:/linux\:/utils\:/util-linux/
Linux Kernel Archive
.UE .
.SH "SEE ALSO"
-.BR shutdown (8),
.BR login (1),
-.BR init (8)
+.BR wtmp (5),
+.BR init (8),
+.BR shutdown (8)
projects / thirdparty / util-linux.git / blobdiff