As I know, the last command shows recent logins by all users. But my PC (CentOS) has been used for roughly a year, and there are many users logged. I tried to used the last command, but it just showed from June 2013 to September 2013.

My question is: how can I show the latest users that have logged in recently, say (December 2013 through Jan 2014)?

  • Could you check if the /var/log/wtmp file is present and its last change time using stat. Jan 9, 2014 at 2:46
  • Also, note that the latest entries in the output of the last command would be at the top. Jan 9, 2014 at 2:56
  • anyway to make it down to the bottom?
    – Thomas
    Jan 9, 2014 at 2:57
  • 1
    Try last | tac Jan 9, 2014 at 2:59
  • 1
    just do a stat: stat /var/log/wtmp Jan 9, 2014 at 2:59

4 Answers 4


You can also use the command lastlog command on Linux. It gives you more granular controls as to ranges of dates when looking through the logs of user logins.

excerpt from lastlog man page

   lastlog - reports the most recent login of all users or of a given user


To find out the users that have logged into a system in the last 100 days.

$ lastlog -b 0 -t 100
Username         Port     From             Latest
sam              pts/0    pegasus          Wed Jan  8 20:32:25 -0500 2014
joe              pts/0    Thu Dec 12 12:47:11 -0500 2013

This shows that the last times these users logged into this system. The range of time shows the last 100 days. Before today (-b 0) and after 100 days ago (-t 100).

You can also show all the users by omitting any range and just seeing every usre that's ever logged in, and the last time they logged in.


last reads from a log file, usually /var/log/wtmp and prints the entries of successful login attempts made by the users in the past. The output is such that the last logged in users entry appears on top. In your case perhaps it went out of notice because of this.

In order to check when was the file /var/log/wtmp was written last, you can use stat command:

stat /var/log/wtmp

In order to print the output in reverse, you can pipe output of last to GNU tac (opposite of cat) as follows:

last | tac

You can try this script:

for user in $( awk -F: '{ print $1}' /etc/passwd)
lastlog=$(sudo lsuser -a time_last_login $user | awk -F'=' '{print $NF}')
echo "$user         \c"; perl -le "print scalar localtime($lastlog);"
  • 1
    Welcome to Unix.SE. Could you explain what advantages this approach has over the existing answers, if any? Feb 6, 2018 at 12:36
  • this script will give last log timestamp for all users in UNIX (AIX)
    – user266746
    Aug 17, 2018 at 12:22
  • Thanks for the info; please edit your answer to mention that. Note too that the question is about CentOS, not AIX. Aug 17, 2018 at 12:32

lastlog only shows users listed in /etc/passwd, so for lastlog to catch users present in /var/log/wtmp file, in a LDAP server, I used this command:

for u in $(last | awk '{printf $1 "\n" }'| sort  | uniq); lastlog -u $u

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.