Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [last]

`last` is a command that shows a listing of the last logged in users.

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

last command reply wrong status

I have a very strange output, while investigating ungraceful shutdowns. All last shutdowns have been listed as "still running". After I did a regular reboot, the listing is correct. Does ...
user avatar
1 vote
0 answers
30 views

How to monitor /dev/pts/X sessions?

I was trying to monitor some pts sessions I spawned using the Python pty module. Its a simple code like the following: import pty pty.spawn("/bin/bash") I can see in the /dev/pts/ directory ...
user avatar
  • 75
0 votes
1 answer
265 views

What causes wtmp to be cleared?

I noticed that on one of my machines the last command returned nothing. I determined the cause of this to be an empty /var/log/wtmp file. What would cause this to be empty? I assume the "tmp"...
user avatar
  • 455
2 votes
0 answers
53 views

last reboot command shows strange behavior (or maybe im wrong)

In last reboot command normally if im not wrong it shows the last reboot time and n-2 reboot time but as you can see in below image it is showing same time for last 4 reboots reboot system boot 3....
user avatar
  • 3,834
0 votes
1 answer
104 views

last: command not found after upgrading CentOS

I upgrade CentOS from 7 to 8. There is no last command. $ which last /usr/bin/which: no last in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin) I fail to install last with dnf install. $...
user avatar
-1 votes
1 answer
280 views

last: invalid option -- 's'

I learned from several posts that we can use the -s (since) option to show login events that took place since a specific date. However, it encountered the error invalid option. root@VM-0-6-centos ~ $ ...
user avatar
0 votes
0 answers
54 views

machine uptime is not consistent with last command

we have 3 rhel servers version 7.6 ( part of cluster with 8 machines ) on rhel server 1 machine uptime is uptime 10:25:51 up 23:48, 1 user, load average: 0.02, 0.09, 0.13 on rhel server 2 machine ...
user avatar
  • 11k
1 vote
0 answers
111 views

Script to add hours and minutes of an individual user, then display on one line

New to Linux, lots to learn! I am attempting to write a bash shell script in vi that will output the number of hours and minutes a user has been logged in over the last 7 days. I am working through ...
user avatar
  • 11
1 vote
3 answers
234 views

How to get last boot times?

I have a raspberry pi. I have a crontab running and telling it to reboot at mid-day every day (sudo reboot now). Here is the result of last reboot -F: myuser@mypiname:~ $ last -F reboot reboot ...
user avatar
  • 111
0 votes
1 answer
66 views

View users who logged in during a specific time period using last

What I'm looking to do is get a sorted list of all users that have logged in during a specific time frame (say, for example, since the start of September). How would I specify a time frame (like my ...
user avatar
  • 101
1 vote
0 answers
58 views

Negative number in the last column of the "last" command

Why do I have a negative number for system boot in the last (duration) column of the "last" command?
user avatar
  • 81
0 votes
0 answers
76 views

Need help deciphering `last reboot -F` output

I have a system where this is the output of last reboot -F reboot system boot 3.10.0-1127.13.1 Tue Aug 18 14:14:16 2020 - Wed Aug 19 07:14:44 2020 (17:00) reboot system boot 3.10.0-1127.10.1 ...
user avatar
  • 11
1 vote
0 answers
66 views

`Last` command not working or am I not logged in?

Last command does not show me as logged in. What should I do? I want to run the last command to see all users logged in on a specific date, but the output of last is wtmp begins followed by a date.
user avatar
  • 11
1 vote
0 answers
280 views

Ubuntu last reboot - repeating end time

I'm seeing the following events and I'm not sure why and how. reboot system boot Tue Dec 31 13:31:03 2019 still running reboot system boot Mon Dec 30 14:15:35 2019 - Tue Dec 31 13:30:46 2019 ...
user avatar
0 votes
1 answer
65 views

What causes multiple simultaneous shut down times in 'last' command output?

I am troubleshooting some outage issues on a server, with the suspicion that the server is restarting intermittently. When I run the last command, I see the following output (I added line numbers for ...
user avatar
0 votes
0 answers
252 views

User Lastlog login datetime did not update

I use lastlog to check latest login datetime. Here are steps I use to update my latest login datetime. 1) Try to Login to that user sudo su userA 2) Exit that user and login to root then check ...
user avatar
0 votes
2 answers
1k views

Get time of the last session in seconds

I'm getting the time of the last session of an specific user using the last command like below: last -aiF -n 1 fakeuser The output of this command is something like: fakeuser pts/0 Tue Nov 27 11:...
user avatar
  • 113
0 votes
1 answer
194 views

How can I write a shell script to filter the last command?

I want to write a script for login statistics. I want to count how many times a user logged in, and then display them in ascending, or descending order, given by the end user. The problme being, i don'...
user avatar
0 votes
2 answers
45 views

how can i make 'last -n' return just the n lines of users?

I wrote this simple awk program: last -n 10 | awk'{print "username: " $1}' I was surprised when i got the following output: > username: someUsername1 > username: someUsername2 > username: ...
user avatar
  • 219
1 vote
2 answers
2k views

MacOS: What file does the command `last` get its information from?

Can't seem to find where this last command gets its information from. Does anyone know what file it uses (specifically for Unix macOS) ? Tried cat /var/log/wtmp, cat /var/run/utmp, cat /var/log/...
user avatar
  • 277
3 votes
3 answers
11k views

how to find lastlog details in solaris

I need the equivalent command of linux lastlog in solaris, need to write a script to find the the users last login date and time in solaris servers. Linux its very easy to fetch using lastlog command. ...
user avatar
  • 61
2 votes
2 answers
336 views

Does a shortcut exist to auto scroll to the top of a command response in terminal?

Is there a shortcut (keyboard) to automatically scroll back to the beginning of a response to a command? Example: I open the terminal and type the 'last' command and press enter. A long lost of ...
user avatar
  • 503
1 vote
1 answer
958 views

Grep regex not working [duplicate]

So I'm creating a simple grep command that gets only the last logged in people who's username starts with 161 and has 3 digits next to it: last | grep "^161[0-9]{3}" However it doesn't print ...
user avatar
5 votes
1 answer
2k views

How to make `last` shows also suspend/resume times?

I have notebook and want to store information for every day, when computer is running or not (with precise to minutes). Here is output from last command: dima tty1 :0 Sat ...
user avatar
  • 197
2 votes
0 answers
2k views

Any difference between a reboot vs. shutdown/restart on AIX?

Is a reboot functionally different than performing a shutdown/restart on AIX servers? If they are the same, why are the timestamps different between the 'last system boot' and 'last reboot'? $ who -...
user avatar
  • 21
0 votes
1 answer
349 views

Using if/else statement in awk

Normally I can detect user's last logon time if last return anything via below function. My question is : if last doesn't return anything then I want to look in the user's home directory date and ...
user avatar
  • 485
1 vote
0 answers
151 views

Ignore certain hosts in last log

I have an ansible job that uses ssh to perform tasks on many servers. It uses an authorized key to gain entry. When I run the last command it just shows a long list of root logins from the ansible ...
user avatar
  • 94
0 votes
1 answer
2k views

What is the meaning of "crash" from the output of the last command?

What is the meaning of "crash" from the output of the last command? root pts/0 mastrt03 Wed Jan 24 11:54 - crash (07:12) We have couple of lines with "crash" on our mastrt03 machine.
user avatar
  • 11k
8 votes
1 answer
11k views

Debian - two entries in `last reboot` in `still running`

What can be a reason for last -x reboot showing two last entries as still running? Besides, I'm pretty sure I did not reboot this server December, 16, though it could be something with power on ...
user avatar
  • 185
3 votes
1 answer
1k views

What is the purpose of the 10th column of the `last` command's output?

I see a suspicious pattern in a last command output on RHEL: $ last reboot reboot system boot 3.10.0-514.21.1. Wed Dec 13 10:25 - 11:53 (01:28) reboot system boot 3.10.0-514.21.1. Mon Oct ...
user avatar
1 vote
0 answers
30 views

Command ‘last’ - problems [duplicate]

I have this problem using the command ‘last’. My task is to find names of people, that have been logged in at night hours (22:00 - 5:00). So I’ve tried to save the first number (22) to a variable and ...
user avatar
7 votes
1 answer
3k views

Understanding the output of last reboot shutdown

When I use the command last -x reboot shutdown I get an output like this: reboot system boot 2.6.32-279.14.1. Tue Jul 18 22:03 - 03:20 (05:17) shutdown system down 2.6.32-279.14.1. Tue Jul 18 ...
user avatar
  • 171
3 votes
0 answers
950 views

What could 'unknown' user in the output of the `last` command mean?

Occasionally I will see an odd entry like this one in my last ouput: (unknown :0 :0 Tues Jul 4 06:51 - 06:51 (00:00) Afaik, this should not happen ever, and I cannot find ...
user avatar
  • 296
2 votes
1 answer
164 views

LinuxMint - `who`, `w` and `last` don't report terminal-emulators anylonger

I'm running an up-to-date version of LinuxMint (an Ubuntu-fork), and I've noticed that who, w and last have all stopped registering activity on terminal-emulators (like xterm) - eg. if you open a ...
user avatar
6 votes
1 answer
2k views

utmp, wtmp and btmp: what is the 'tmp'

From the earlier question: why are utmp, wtmp and btmp called as they are? I would like to now what the 'tmp' part is. Is it 'temp/temporary'. As you can see from the earlier question, that part ...
user avatar
  • 1,175
1 vote
1 answer
447 views

Why do I get this at the end of a `last` command?

When I run the last command on one of my Raspberry Pi's running Raspbian I get this at the end: wtmp begins Thu Jan 1 01:00:01 1970 When I run the last command on a proper operating system, such as ...
user avatar
  • 1,175
0 votes
0 answers
121 views

Last users logged in the past 30 minutes

I used this command in ubuntu to find the last ussers logged in the past 30 minutes: last -s -30m --fullnames |head -n -1|awk '{print $1}' | sort -u I need the equivalent for Centos 7. For CentOS ...
user avatar
2 votes
0 answers
92 views

How to view users logged in since last 5 minutes in linux command line? [duplicate]

I am fairly new to linux and trying to learn the terminal commands. I want to see the list of users who logged in since last 5 minutes. I searched the internet but almost every place solution uses a ...
user avatar
  • 171
3 votes
1 answer
742 views

last reboot -F shows overlapping timespans

I just found some odd behaviour on one of our servers that I can't explain myself. It is about both middle lines. I would assume that the timespans for the boot user must not overlap, however, they do:...
user avatar
1 vote
0 answers
835 views

Why is there a difference between the last and lastlog command records, and why is there no recent login record for user in lastlog records?

While testing the last command on my system I got the following result and could not make sense of the lines with down and crash at their ends, as all seem to be connected to a tty7 login: george ...
user avatar
1 vote
2 answers
2k views

last - user reboot - logged-in period

I have the following lines extracted from the output of last. It shows two reboots, and that userA was logged in right up to the reboot. So far, I am able to interpret the data. However, what I do ...
user avatar
  • 215
0 votes
1 answer
177 views

how to read ssh output from 'last' and 'who' command

I have just used the command 'last' to see who has logged into my server. I am unsure how to read some of the output, particularly in Column 2 where it states pts/l and :0. Instead of spoon feeding ...
user avatar
1 vote
1 answer
2k views

last reboot in local time zone?

Is there a way to tell this command to output the data in local time (not UTC)? last reboot Version: last --version last von util-linux 2.27.1
user avatar
  • 1,137
1 vote
0 answers
56 views

Lots of ftpdxxx users on last command

When I execute "last" command to see users that have logged on my system, I have many connections like these: ftp ftpd28575 66.249.66.179 Thu Aug 11 20:41 - 20:42 (00:00) ftp ...
user avatar
0 votes
1 answer
1k views

Does "last" command in linux reset after a specific amount of time?

I maintain a Debian multipurpose server and I'm the sole admin. I execute the lastcommand every time I ssh into the server to check if I recognize every user who have used its service and if they're ...
user avatar
  • 2,017
0 votes
1 answer
67 views

running "last" printed suspicious output

I invoked last from bash on my personal computer and I have this output user pts/2 :0 Wed Jul 27 09:15 still logged in user pts/1 :0 Wed Jul ...
user avatar
  • 253
6 votes
2 answers
15k views

How to find Directories that updated last day in linux?

I have a problem, like I need to find the directories that got updated yesterday. I tried using find command but its listing all the files that got updated in the directories. But I need only the ...
user avatar
1 vote
0 answers
79 views

Send new login & logout logs to a database

I want to know how to send new login and logout logs to a database. I know that last command outputs the "lasts" login info. But, I found the following problems: How to filter to only get new logs? ...
user avatar
  • 171
0 votes
1 answer
828 views

The last log for reboot appeared twice

Does anyone know what's the meaning of my last command? reboot system boot 2.6.32-431.11.2. Sat May 28 15:06 - 05:01 (1+13:54) reboot system boot 2.6.32-431.11.2. Sat May 28 05:03 - 05:01 (1+23:...
user avatar
  • 260
1 vote
1 answer
58 views

Logins in an interval?

How can I get who was logged in in an interval? I tried last -t, but it was not what I was looking for. I want to get who was logged in between May 11. 10:00:00 and May 15. 22:00:00 for example.
user avatar
  • 11