I wrote this simple awk program:

last -n 10 | awk'{print "username: " $1}'

I was surprised when i got the following output:

> username: someUsername1
> username: someUsername2
> username: someUsername3
> ...
> username: someUsername10
> username: 
> username: wtmp

using last -n 10 | wc -l i learned that the last command return two more lines than the number i gave it (the output was 12)

I checked in man last and didn't find anything about those two extra lines or how to get rid of them.

what are those blank and 'wtmp' lines? and how can i ignore them? (maybe in the side of the awk?)



A generic solution which will work everywhere, and when there are fewer than ten entries in the login database, is to trim the last two lines:

last -n 10 | head -n -2 | awk'{print "username: " $1}'

Recent versions of util-linux (2.30.2 and later) allow the wtmp line to be dropped:

last -n 10 --time-format=notime | awk'{print "username: " $1}'

If I run last without any arguments, I get the following output:

wtmp begins Fri Sep 22 18:15:02 2017

And an empty line before it. This is the date from which the logins are recorded.

You can get rid of this using head.

last | head -n10
  • In fact, you may drop all options to last as you're limiting the number of lines with head anyway. Also, 10 lines is the default for head (and tail).
    – Kusalananda
    Nov 5 '18 at 11:12
  • Good point. Will edit my answer to include this.
    – Panki
    Nov 5 '18 at 11:14
  • This fails when there are fewer than ten entries in wtmp. Nov 5 '18 at 11:17
  • thanks! but Stephan solution is cover all cases
    – Z E Nir
    Nov 5 '18 at 11:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.