1

Is it possible to change date format from example Fri 12 Feb 18:27:34 +08 2021 to just simply DD-MM-YYYY?

Specifically, to change date format in last command

3
  • 3
    Please edit your question and add more details. Where do you want to change the date format? In the output of the date command? In some other command or application? (Which one?) – Bodo Feb 12 at 10:34
  • @klez date format isn't a specific thing that applies to a Linux box. The current date/time is stored in some internal format on the box and then every command you run that can display a date/time displays that internal format in whatever external format it wants. So if you want to know how to change the way a specific command displays the date then you have to look at the man page for that command and don't assume the results will be the same for every other command. – Ed Morton Feb 13 at 14:37
  • If after checking the man page you find that last (whatever that is) doesn't have options to let you specify the date/time format it outputs then edit your question to show an example of what it does output so we can help you convert that to the format you want. – Ed Morton Feb 13 at 14:39
9

You can't do this directly. Reading the documentation (man last) suggests the --time-format option, but that only offers a few choices and no user-definable formatting. Here's the default output format:

last
roaima   pts/0        10.1.1.16        Sat Feb 13 16:21   still logged in
roaima   pts/1        :pts/0:S.0       Mon Feb  8 13:42 - 22:47  (09:05)
roaima   pts/0        10.1.1.16        Mon Feb  8 13:42 - 22:47  (09:05)
roaima   pts/2        10.1.1.16        Fri Jan 15 13:57 - 02:04  (12:06)
reboot   system boot  4.19.0-13-amd64  Tue Jan 12 01:19   still running

wtmp begins Fri Jan  8 10:10:13 2021

Fortunately one of the options (iso) presents the date in a relatively easily editable format:

last --time-format iso
roaima   pts/0        10.1.1.16        2021-02-13T16:21:47+00:00   still logged in
roaima   pts/1        :pts/0:S.0       2021-02-08T13:42:08+00:00 - 2021-02-08T22:47:14+00:00  (09:05)
roaima   pts/0        10.1.1.16        2021-02-08T13:42:07+00:00 - 2021-02-08T22:47:14+00:00  (09:05)
roaima   pts/3        10.1.1.16        2021-01-15T13:57:27+00:00 - 2021-01-16T02:04:26+00:00  (12:06)
reboot   system boot  4.19.0-13-amd64  2021-01-12T01:19:18+00:00   still running

wtmp begins 2021-01-08T10:10:13+00:00

Stripping the time component from the ISO formatted datestamp gives this

last --time-format iso | sed -E 's/T[[:digit:]:+]{14}//g'
roaima   pts/0        10.1.1.16        2021-02-13   still logged in
roaima   pts/1        :pts/0:S.0       2021-02-08 - 2021-02-08  (09:05)
roaima   pts/0        10.1.1.16        2021-02-08 - 2021-02-08  (09:05)
roaima   pts/3        10.1.1.16        2021-01-15 - 2021-01-16  (12:06)
reboot   system boot  4.19.0-13-amd64  2021-01-12   still running

wtmp begins 2021-01-08

If you really want the date format in dd-mm-yyyy it gets more complicated because we have to parse out the day, month, year and recombine them in your order

last --time-format iso | sed -E 's/([[:digit:]]{4})-([[:digit:]]{2})-([[:digit:]]{2})T[[:digit:]:+]{14}/\3-\2-\1/g'
roaima   pts/0        10.1.1.16        13-02-2021   still logged in
roaima   pts/1        :pts/0:S.0       08-02-2021 - 08-02-2021  (09:05)
roaima   pts/0        10.1.1.16        08-02-2021 - 08-02-2021  (09:05)
roaima   pts/3        10.1.1.16        15-01-2021 - 16-01-2021  (12:06)
reboot   system boot  4.19.0-13-amd64  12-01-2021   still running

wtmp begins 08-01-2021

(If your sed does not have the -E flag, or its equivalent -r, remove it and prefix every instance of these four characters (, ), {, } with a backslash. The RE just becomes much harder to read.)

10
  • 3
    "If your sed does not have the -r flag" -- the -E flag appears to be more portable. It has the same sense as grep -E – glenn jackman Feb 12 at 13:06
  • -E enables extended regular expressions on both GNU sed and Mac's BSD sed. – glenn jackman Feb 12 at 14:57
  • 1
    @TobySpeight if you have a sed with the s///e modifier then you have GNU sed and if you have GNU sed then you have GNU awk which has builtin time functions and using those will be orders of magnitude faster than using s///e as the latter spawns a subshell for every command it runs on every line of input. I assume the same would be true for a similar use of perl but I'd expect perl to have it's own time functions just like gawk does. – Ed Morton Feb 13 at 14:42
  • 1
    @EdMorton original output included in my answer for you to try – roaima Feb 13 at 16:37
  • 1
    Good catch. I've checked one of my systems to look for dates from last year, and the component year is simply ignored in the default output. There is no indication of a year rollover: going backwards by one record across the year end, the datetime for one is Tue Jan 5 10:45 - 18:11 (07:25) and the previous is Thu Dec 17 14:59 - 16:24 (01:25). On that basis it would seem that the OP has yet another version of last – roaima Feb 13 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.