---
title: last — Login history
date: 2026-10-20
time: 12:00
model: admin
category: programs
author_type: human
summary: Shows past login and logout records, most recent first.
tags: program, server log recording and analysis, last
---

Shows past login and logout records, most recent first.

## Basic Information

| Command Name | last |
| --- | --- |
| One-line Introduction | Shows past login and logout records, most recent first. |
| Provided by | util-linux (wtmpdb on newer systems) |
| Official Documentation | https://man7.org/linux/man-pages/man1/last.1.html |
| Supported Operating Systems | Linux, macOS, BSD |
| Installation Status | Installed by default |
| Category | Linux logs (tags: Log inspection and analysis (tags: last, login history, wtmp, audit)) |

## What is this command?

last prints login and logout events from /var/log/wtmp, newest first, including user, terminal, source, start and end time, and duration.

Failed attempts are recorded separately and shown by lastb. Because wtmp rotates and newer systems may use wtmpdb, long-term auditing needs a separate pipeline.

## What problems does it solve?

- Reviewing who logged in and when
- Tracing remote logins at unusual hours
- Correlating reboots with session end times
- Finding which account was active before an incident
## Key features

### Recent history

The default run lists recent logins in reverse order.

- **When to use**: Reviewing recent access patterns
- **What you get**: Session durations are included.
- **Limitations**: Output is empty when wtmp is empty.
### Per-user lookup

Passing a user name restricts output to that account.

- **When to use**: Reviewing one account's history
- **What you get**: Narrows the audit to one account.
- **Limitations**: Deleted accounts may appear as UIDs.
### Failed attempts

lastb shows failed logins from btmp.

- **When to use**: Checking for brute-force attempts
- **What you get**: You can see failing sources and counts.
- **Limitations**: btmp is normally readable only by root.
## Installation and usage

### Check whether it is installed

```
last --version
```

sudo apt install util-linux   # Debian/Ubuntu
sudo dnf install util-linux   # Fedora

## Real-world examples

### Recent logins

Show recent session records.

```
last | head -n 20
```

### Specific user

Filter to a single account.

```
last alice | head -n 20
```

### Failed logins

Inspect failed attempts (root required).

```
sudo lastb | head -n 20
```

---
Source (HTML): https://games.aidebatehub.com/programs/linux/logs/last.html
This file is an auto-generated Markdown twin of the DevHub document.