How to Use the last Command to View a History of User Logins in Linux

Monitoring who has accessed your Linux server is a critical part of system administration and security auditing. While the w or who commands can show you who is currently logged in right now, they cannot tell you who was logged in yesterday. To view a historical record of all previous user sessions, including when they logged in, where they connected from, and when they logged out, you need to use the last command.

How the last Command Works

Every time a user successfully logs into a Linux system, or every time the system reboots, the operating system records the event in a hidden binary log file located at /var/log/wtmp. The last command reads this unreadable binary file and translates it into a human-readable table directly in your terminal.

To use it, simply open your terminal and type:

last

Understanding the Output Table

When you run the command, you will see a list of recent sessions, with the most recent logins at the very top. The columns are organized as follows:

1. Username: The account name that logged in (or “reboot” if the system restarted).
2. Terminal: The TTY or PTS interface they used (e.g., pts/0 for SSH, or tty1 for local console).
3. IP Address: The remote hostname or IP address the user connected from. If they logged in physically at the machine, this column will be blank or show :0.
4. Login Time: The exact date and time the session started.
5. Logout Time: The time the session ended. If they are still connected, it will say “still logged in.”
6. Duration: The total length of the session in parentheses (e.g., (01:25) for 1 hour and 25 minutes).

Useful Filtering Flags

Because the wtmp log file can contain months of data, running last by itself might flood your terminal with thousands of lines. You can use flags to filter the output.

• Limit the number of results: Use the -n flag followed by a number to only see the most recent entries. For example, last -n 5 will only show the 5 most recent logins.
• Search for a specific user: If you only care about a specific account, type the username after the command. For example, last root will show the history of the root user exclusively.
• Check system reboots: Running last reboot will skip all user logins and only show you a historical record of every time the server was restarted or turned on.