LAST(1)

✨ LAST(1) — the "who was here" manual ✨

okay bestie, gather round, because this is last and lastb, living in the User Commands section of your manual, and they are literally the receipts of your system. 💅

---

🌸 NAME 🌸

last, lastb — show a listing of last logged in users

no cap, that's the whole vibe: it tells you who logged in, when, and from where. 🕵️♀️

---

🎀 SYNOPSIS 🎀

last [options] [username|tty]...

lastb [options] [username|tty]...

two icons, same energy, slightly different tea. 🫶

---

🦋 DESCRIPTION 🦋

so last literally searches backwards through the /var/log/wtmp file (or whatever file you handed it with the -f option, we'll get there) and shows you a whole list of every user who logged in and out since that file was created. it's giving "scroll up in the group chat to find out what happened." 😭

and you can be picky about it! give it one or more usernames and/or ttys and last will show you only the entries matching those arguments. and here's the cute part — names of ttys can be abbreviated, so last 0 is the same as last tty0. iconic shorthand, we love to see it. ✨

now, when last catches a SIGINT or SIGQUIT signal, it will show you how far it has searched through the file. and in the case of the SIGINT signal (that's the one you generate with the interrupt key, usually control-C, yes the panic button 🫣), last will then terminate. so it tells you where it got to before it dips. periodt.

the pseudo user reboot logs in each and every time the system is rebooted. so last reboot will show a log of all the reboots since the log file was created. it's literally the system's own "back from the dead" check-in. 🔥

and lastb? same as last, except by default it shows a log of the /var/log/btmp file, which contains all the bad login attempts. yes bestie, the failed ones. the "who tried to break in" file. 💀

---

💖 OPTIONS 💖

• -a, --hostlast — display the hostname in the last column. super useful in combination with the -d option.
• -d, --dns — for non-local logins, Linux stores not only the host name of the remote host, but its IP number as well. this option translates that IP number back into a hostname. name reveal, but make it network-y. 🌈
• -f, --file file — tell last to use a specific file instead of /var/log/wtmp. plot twist: the -f option can be given multiple times, and all of the specified files will be processed. the more the merrier. ✨
• -F, --fulltimes — print full login and logout times and dates. no truncation, no hiding, the whole timestamp.
• -i, --ip — like -d, but displays the host's IP number instead of the name. same energy, opposite direction. 🔄
• -n, --limit number — the maximum amount of logins to show.
• -number — the same as -n number. little shortcut, iykyk.
• -p, --present time — display the users who were present at the specified time. for ways to specify time, see the section TIME FORMATS below. 👀
• -R, --nohostname — suppresses the display of the hostname field. bye bestie, you didn't make the cut. 🙈
• -s, --since time — display the state of logins since the specified time. the option can be combined with -t to cover a period. it's giving "range slider." 🎚️
• -t, --until time — display the state of logins until the specified time.
• -T, --tab-separated — use ASCII tab characters to separate the columns in the output instead of spaces. for the spreadsheet girlies. 📊
• --time-format format — define the appearance of the timestamp to be one of: notime, short, full, or iso. the notime variant will not print any timestamps at all, short is the default, and full is the same as the --fulltimes option. the iso variant will display the timestamp in ISO-8601 format. and listen — the ISO format contains timezone information, making it preferable when printouts are investigated outside of the system. so if you're sharing screenshots with the group chat across timezones, go ISO. 🌍
• -w, --fullnames — display full user names and domain names / IP addresses. when this option is not specified, user names are truncated to 8 characters, and domain names and IP addresses to 16 characters. and an asterisk is shown as the last character of truncated fields. so that little * is the "…and more" of the terminal. 💅
• -x, --system — display the system shutdown entries and run level changes. the dramatic plot beats of your machine's life. 🎬
• -h, --help — display help text and exit.
• -V, --version — display version and exit.

---

⭐ TIME FORMATS ⭐

the argument time allows the following forms:

 YYYYMMDDhhmmss
 "YYYY-MM-DD hh:mm:ss"
 "YYYY-MM-DD hh:mm"      (seconds is 00)
 YYYY-MM-DD              (time is 00:00:00)
 hh:mm:ss                (date is today)
 hh:mm                   (date is today, seconds is 00)
 now
 today                   (time is 00:00:00)
 yesterday               (time is 00:00:00)
 -number[smhd]           (seconds/minutes/hours/days before now)

examples of the -number[smhd] format are: -5m, -6h, -2d. and the unit specifier may be longer: -5min, -6hours, -2days. flexible queen. 👑

---

🌈 FILES 🌈

/var/log/wtmp, /var/log/btmp

---

💜 NOTES 💜

okay important, listen up bestie:

the files wtmp and btmp might not be found. the system only logs information in these files if they are present. this is a local configuration issue. if you want the files to be used, they can be created with a simple touch(1) command (for example, touch /var/log/wtmp). so if last is giving you nothing, check if the file even exists first. 😭

an empty entry is a valid type of wtmp entry. it means that an empty file or file with zeros is not interpreted as an error. so don't panic, it's fine, it's valid. ✨

and here's the lore drop: the utmp file format uses fixed sizes of strings, which means that very long strings are impossible to store in the file and impossible to display by last. the usual limits are 32 bytes for a user and line name and 256 bytes for a hostname. so if a name looks cut off, that's not a bug, that's the file format doing its thing. 💀

---

🧚 AUTHORS 🧚

Miquel van Smoorenburg <miquels@cistron.nl>

shoutout to the legend. 🫶

---

🍓 SEE ALSO 🍓

login(1), wtmp(5), init(8), shutdown(8)

go read those too, they're all connected. it's a whole cinematic universe. 🎀

---

😭 REPORTING BUGS 😭

for bug reports, use the issue tracker <https://github.com/util-linux/util-linux/issues>.

don't suffer in silence, bestie. tell the maintainers. 📝

---

👑 AVAILABILITY 👑

the last command is part of the util-linux package which can be downloaded from Linux Kernel Archive <https://www.kernel.org/pub/linux/utils/util-linux/>.

---

and that's the whole page, no cap. 💖

okay so final sign-off moment: this was util-linux 2.42.4, dated 2026-09-21, and it's the LAST(1) page. love that for us. go check your logs, bestie. slay. 💅✨🦋