LAST(1)

💖 LAST(1) — the "who was here" manual, bestie edition 💖

okay so you want to know who logged in, when, and from where? Say less. This is the last manual page from the User Commands corner of the util-linux universe, and I'm gonna walk you through it like we're texting at 2am. 🦋

---

✨ NAME ✨

last, lastb — show a listing of last logged in users 💅

---

🎀 SYNOPSIS 🎀

last [options] [username|tty]...

lastb [options] [username|tty]...

---

🌸 DESCRIPTION 🌸

So last searches backwards through the /var/log/wtmp file — or whichever file you hand it with the -f option — and shows you a whole list of every user who logged in (and out 🫶) since that file was created. It's giving receipts, honestly.

You can also pass one or more usernames and/or ttys, and then last will show only the entries that match those arguments. And here's a cute little shortcut: tty names can be abbreviated, so last 0 hits the exact same as last tty0. iykyk. ✨

When it catches a SIGINT or SIGQUIT signal, last will show how far it has searched through the file. And in the case of the SIGINT signal (that's the one your interrupt key generates, usually control-C), last will then terminate. 😭 so dramatic of it.

The pseudo user reboot logs in each time the system is rebooted. So last reboot will show a log of all the reboots since the log file was created. Main character energy fr fr. 👑

lastb is the same as last, except that by default it shows a log of the /var/log/btmp file, which contains all the bad login attempts. 🙈 (the flops, the fails, the "wrong password" girlies)

---

💅 OPTIONS 💅

• -a, --hostlast — shows the hostname in the last column. Chef's kiss when you pair it with the -d option.
• -d, --dns — for non-local logins, Linux stores not just the host name of the remote host but its IP number too. This option translates that IP number back into a hostname. ✨
• -f, --file file — tells last to use a specific file instead of /var/log/wtmp. And plot twist: you can give -f multiple times, and all of the specified files will be processed. obsessed.
• -F, --fulltimes — prints full login and logout times and dates. no more mystery. ⭐
• -i, --ip — like -d, but displays the host's IP number instead of the name. pick your fighter.
• -n, --limit number — the maximum amount of logins to show. boundaries, periodt.
• -number — the same as -n number. just shorter. 💅
• -p, --present time — displays the users who were present at the specified time. for ways to specify time, peep the TIME FORMATS section down below 👇
• -R, --nohostname — suppresses the display of the hostname field. bye bestie 🫶
• -s, --since time — displays the state of logins since the specified time. can be combined with -t to cover a period. iconic duo.
• -t, --until time — displays the state of logins until the specified time. 🌸
• -T, --tab-separated — uses ASCII tab characters to separate the columns in the output instead of spaces. for the spreadsheet girlies. 📊
• --time-format format — defines the appearance of the timestamp to be one of: notime, short, full, or iso. The notime variant will not print any timestamps at all, short is the default, and full is the same as the --fulltimes option. The iso variant displays the timestamp in ISO-8601 format. And ngl, the ISO format contains timezone information, making it preferable when printouts are investigated outside of the system. 🌈
• -w, --fullnames — displays full user names and domain names / IP addresses. When this option is not specified, user names get truncated to 8 characters, and domain names and IP addresses to 16 characters. An asterisk is shown as the last character of truncated fields. the little * is doing so much. 💀
• -x, --system — displays the system shutdown entries and run level changes. 🔥
• -h, --help — displays help text and exits. the "just tell me what to do" button.
• -V, --version — displays version and exits. 🎀

---

⏰ TIME FORMATS ⏰

The argument time allows the following forms:

YYYYMMDDhhmmss
"YYYY-MM-DD hh:mm:ss"
"YYYY-MM-DD hh:mm"      (seconds is 00)
YYYY-MM-DD              (time is 00:00:00)
hh:mm:ss                (date is today)
hh:mm                   (date is today, seconds is 00)
now
today                   (time is 00:00:00)
yesterday               (time is 00:00:00)
-number[smhd]           (seconds/minutes/hours/days before now)

Examples of the -number[smhd] format are: -5m, -6h, -2d. And the unit specifier may be longer: -5min, -6hours, -2days. she's flexible like that. 🧚

---

📁 FILES 📁

/var/log/wtmp, /var/log/btmp

---

🫶 NOTES 🫶

The files wtmp and btmp might not be found. The system only logs information in these files if they are present. This is a local configuration issue. If you want the files to be used, they can be created with a simple touch(1) command (for example, touch /var/log/wtmp). lowkey a vibe check for your system setup. ✨

An empty entry is a valid type of wtmp entry. It means that an empty file or file with zeros is not interpreted as an error. so don't panic bestie.

The utmp file format uses fixed sizes of strings, which means that very long strings are impossible to store in the file and impossible to display by last. The usual limits are 32 bytes for a user and line name and 256 bytes for a hostname. no cap, that's just the format. 😭

---

👑 AUTHORS 👑

Miquel van Smoorenburg <miquels@cistron.nl>

---

🌈 SEE ALSO 🌈

login(1), wtmp(5), init(8), shutdown(8)

---

🐛 REPORTING BUGS 🐛

For bug reports, use the issue tracker <https://github.com/util-linux/util-linux/issues>. pls be nice to the maintainers, they're doing their best. 💖

---

💜 AVAILABILITY 💜

The last command is part of the util-linux package which can be downloaded from Linux Kernel Archive <https://www.kernel.org/pub/linux/utils/util-linux/>. go get her. 🦋

---

and that's the whole page, bestie!! 🎀 this one's coming at you from util-linux 2.42.4, dated 2026-09-21, and it's the LAST(1) manual — slay, read responsibly, and go check who's been logging into your machine 👀💅