How to View Login History Using the last Command in Linux

When you are managing a highly sensitive Linux server, ensuring that only authorized administrators are accessing the system is a critical security requirement. If you suspect an unauthorized person gained access to a specific account over the weekend, you must perform an immediate forensic audit to view the login history. To instantly pull a comprehensive, time-stamped report of exactly who logged into the server and when, you must use the last command.

How the last Command Works

The last command does not perform active monitoring; it is a passive forensic tool. Every single time a user successfully logs into a Linux machine, the kernel silently writes a highly structured record of that event directly into a hidden binary log file located at /var/log/wtmp. The last command simply parses that binary file and translates it into human-readable text.

To view the master login history, simply type the command and press Enter:

last

The server will instantly output a chronological list of successful logins, with the most recent login at the absolute top of the screen. A standard output row looks like this:

jsmith   pts/0   192.168.1.50   Tue Nov 12 14:32 - 15:45  (01:13)

This row provides absolute forensic clarity: The user jsmith logged into terminal pts/0 from the IP address 192.168.1.50 on Tuesday, November 12th at 2:32 PM. They remained logged in for exactly 1 hour and 13 minutes.

Filtering the Audit Log

If your server has been running for three years, typing a raw last command will flood your terminal with thousands of lines of data, completely overwhelming your screen.

To restrict the output to only the 10 most recent logins, use the -n (number) flag:

last -n 10

If you only care about a specific user account (for example, if you suspect the tjones account was compromised), you can simply append their exact username to the end of the command:

last tjones

This instantly filters out every other user on the system, showing you exclusively when tjones successfully accessed the server.

Security Note: Because the `last` command only reads successful logins, it cannot tell you if someone is actively trying to brute-force a password. To view failed login attempts, you must use the completely separate `lastb` command, which requires sudo privileges.