CentOS last command

The last command with no options looks at and interprets the binary file /var/log/wtmp and displays the users that logged in and out as well as runlevel changes and reboots since the file was created (it might seem suspicious if the wtmp file only goes back a day or two but the server has an uptime of 400 days).


Last logged in users

It will display the username, terminal, IP address, date and time logged in, logged out and duration of the session or read “still logged in” if that session is still active.


Will show “reboot”, “system boot”, kernel version and time.

Options or flags for the last command

This will show the last 10 lines of output from the last command.

last -n 10

Display hostname instead of IP address with -d
last -d

Display logins as of a specified time – Jan 1, 2014 at 01:00:00, format is YYYYMMDDHHmmss

last -t 20140101010000