How to View Historical User Logins Using the last Command in Linux

When you manage a multi-user Linux server, you often need to know exactly who is currently logged into the system, what terminal they are connected to, and when their session began. While the who and w commands show you the users currently active in real-time, they do not tell you who was logged in yesterday. To view a historical record of all user logins and logouts, Linux provides the powerful last command.

How the last Command Works

The last command operates by parsing a hidden binary system file located at /var/log/wtmp. This file automatically records every single login and logout event generated by the operating system.

To view the most recent logins, simply run the command with no arguments:

last

The terminal will output a dense, multi-column list. It will display the username, the terminal line (like pts/0 or tty1), the IP address the user connected from (if they used SSH), the exact date and time they logged in, and the time they logged out.

Because the wtmp file can grow massively over months of server operation, running last without any flags will often flood your screen with thousands of lines of text. To limit the output to the most recent 10 logins, use the -n (number) flag:

last -n 10

Filtering by Specific Users

If you suspect a specific user account (for example, a user named charlie) has been compromised, you do not need to scroll through the entire system history to find their activity. You can simply pass the username as an argument to the command.

last charlie

The terminal will instantly filter the output, displaying only the historical login and logout timestamps for that specific user.

Tracking System Reboots

The last command is not strictly limited to human users. The operating system kernel itself logs a pseudo-user entry named reboot every single time the server is restarted or powered on.

If you want to view a complete historical timeline of exactly when the server was restarted over the past year, you can run:

last reboot

This is an invaluable troubleshooting trick for system administrators trying to correlate random database crashes or network disconnections with unexpected, unannounced server reboots.