How to View Login History Using the last Command in Linux

When you are managing a secure Linux server, you must constantly monitor who is accessing the system. If you suspect an unauthorized contractor logged into the database over the weekend, you cannot rely on the standard whoami or w commands, because those tools only display users who are currently active this exact second. To mathematically interrogate the kernel’s historical security logs and generate a massive chronological list of every single person who has recently accessed the machine, you must use the last command.

How the last Command Works

The last command is a direct, low-level parser. Every time a user successfully authenticates (via SSH, the local terminal, or a graphical login screen), the Linux kernel secretly writes a highly structured binary record into the heavily guarded /var/log/wtmp file. Because this file is raw binary data, you cannot read it with a standard text editor like nano or cat. The last command mathematically translates that binary data into a human-readable table.

To execute a full historical dump, simply type the command into your terminal:

last

The system will instantly output a massive, multi-column grid that looks like this:

admin    pts/1        192.168.1.50     Mon Sep  4 08:15   still logged in
j_smith  pts/0        10.0.0.45        Sun Sep  3 22:10 - 23:15  (01:05)
reboot   system boot  5.15.0-78-gen    Sat Sep  2 14:00   still running

This table tells you exactly who logged in (j_smith), how they connected (pts/0), the exact IP address they connected from (10.0.0.45), the exact millisecond they entered the system, and exactly how long their session lasted (1 hour and 5 minutes).

Filtering the Security Output

On a highly active enterprise server, running the last command by itself might dump 10,000 lines of data to your screen, making it impossible to read. You must use specific flags to restrict the output.

If you only want to see the 10 most recent logins, append the numerical limit flag:

last -10

If you are explicitly auditing a specific user (like the suspected contractor j_smith), you can force the engine to completely ignore everyone else by appending their exact username to the command:

last j_smith

This will instantly filter the massive binary log and only output the historical sessions belonging to that specific individual, allowing you to easily track their exact movements.