lastShow login history, reboots and failed logins
last lists who logged in, from where, when and for how long, plus every reboot, newest first. Its sibling lastb shows failed login attempts. Together they answer 'who was on this box last night?' and 'when did it reboot?' in seconds.
last [-n N] [-a] [-F] [-i] [-x] [-s TIME] [-t TIME] [USER...] [TTY...] [reboot]You're about to restart a service and want to know who else has been working on the box recently.
lastReads the login records in /var/log/wtmp and prints them newest first.
Every interactive login creates a record in /var/log/wtmp (a binary file of utmp structs): the login program, sshd or the display manager writes a line with user, terminal, remote host and time at login and a matching 'dead process' record at logout. Boots and shutdowns are written as the pseudo-users reboot and shutdown. last reads the file backwards and pairs logins with logouts to print each session's duration; a session without a logout record shows 'still logged in', or 'crash' / 'down' if the system went away first. Failed logins go to /var/log/btmp, which only root can read, and lastb prints them. Current sessions are in /run/utmp (shown by who and w). These files are rotated by logrotate (monthly on Ubuntu), so history is limited to what's left; 'wtmp begins' at the bottom tells you how far back it goes. Non-interactive SSH commands and SFTP-only sessions may not be recorded, and newer distributions are moving to wtmpdb (a SQLite database) for Y2038 safety, with the same last command on top.
-n NShow only the last N recordsUSER / TTYFilter by user name or terminal (pts/0, tty1)rebootOnly boot records: when the machine (re)started and with which kernel-xAlso show shutdowns and runlevel changes-FFull date and time, including seconds and year-i / -aSource as IP / put the hostname in the last column (not truncated)-s / -t TIMESince / until a time: -s yesterday, -s '2026-10-28 22:00'-f FILERead another file, e.g. a rotated /var/log/wtmp.1lastbFailed login attempts from /var/log/btmp (root only)Treating last as a complete, trustworthy audit trailwtmp is a local file root can edit or truncate, it rotates away, and some sessions (non-interactive ssh commands, SFTP, su) may not appear.
Also use the journal or auth.log, auditd, and central log shippingRunning lastb without sudo and concluding there were no failuresbtmp is root-only; without root you get an error, or nothing in some scripts that hide stderr.
sudo lastbAssuming 'still logged in' always means the user is on right nowIf the system crashed or wtmp missed the logout, the old session never got a closing record.
Check current sessions with who or w (from /run/utmp)Try these on a Linux machine of your own. Each task has a hint and a solution.
Show the last 5 logins on this machine with full timestamps.
Show when the machine booted, and compare with uptime.
List failed login attempts, if any, and count them per source address.
lastShow login history, reboots and failed logins
last lists who logged in, from where, when and for how long, plus every reboot, newest first. Its sibling lastb shows failed login attempts. Together they answer 'who was on this box last night?' and 'when did it reboot?' in seconds.
last [-n N] [-a] [-F] [-i] [-x] [-s TIME] [-t TIME] [USER...] [TTY...] [reboot]You're about to restart a service and want to know who else has been working on the box recently.
lastReads the login records in /var/log/wtmp and prints them newest first.
Every interactive login creates a record in /var/log/wtmp (a binary file of utmp structs): the login program, sshd or the display manager writes a line with user, terminal, remote host and time at login and a matching 'dead process' record at logout. Boots and shutdowns are written as the pseudo-users reboot and shutdown. last reads the file backwards and pairs logins with logouts to print each session's duration; a session without a logout record shows 'still logged in', or 'crash' / 'down' if the system went away first. Failed logins go to /var/log/btmp, which only root can read, and lastb prints them. Current sessions are in /run/utmp (shown by who and w). These files are rotated by logrotate (monthly on Ubuntu), so history is limited to what's left; 'wtmp begins' at the bottom tells you how far back it goes. Non-interactive SSH commands and SFTP-only sessions may not be recorded, and newer distributions are moving to wtmpdb (a SQLite database) for Y2038 safety, with the same last command on top.
-n NShow only the last N recordsUSER / TTYFilter by user name or terminal (pts/0, tty1)rebootOnly boot records: when the machine (re)started and with which kernel-xAlso show shutdowns and runlevel changes-FFull date and time, including seconds and year-i / -aSource as IP / put the hostname in the last column (not truncated)-s / -t TIMESince / until a time: -s yesterday, -s '2026-10-28 22:00'-f FILERead another file, e.g. a rotated /var/log/wtmp.1lastbFailed login attempts from /var/log/btmp (root only)Treating last as a complete, trustworthy audit trailwtmp is a local file root can edit or truncate, it rotates away, and some sessions (non-interactive ssh commands, SFTP, su) may not appear.
Also use the journal or auth.log, auditd, and central log shippingRunning lastb without sudo and concluding there were no failuresbtmp is root-only; without root you get an error, or nothing in some scripts that hide stderr.
sudo lastbAssuming 'still logged in' always means the user is on right nowIf the system crashed or wtmp missed the logout, the old session never got a closing record.
Check current sessions with who or w (from /run/utmp)Try these on a Linux machine of your own. Each task has a hint and a solution.
Show the last 5 logins on this machine with full timestamps.
Show when the machine booted, and compare with uptime.
List failed login attempts, if any, and count them per source address.