last命令应用详解

定义

last指令是Linux系统中用于显示用户登录记录的命令。它从系统的登录日志文件（通常是/var/log/wtmp）中读取数据，并展示用户的登录时间、来源、终端等信息。通过last指令，系统管理员可以方便地查看谁在何时登录过系统，以及系统的历史活动情况。

应用

last

该命令将列出所有用户的登录记录，包括登录时间、持续时间、登录来源等信息。这是last指令最基本的用法。

[root@localhost ~]# last
root     pts/12       192.168.5.2      Wed Dec  4 16:42   still logged in
root     pts/2        192.168.5.2      Wed Dec  4 16:34   still logged in
root     pts/0        192.168.5.2      Wed Dec  4 16:34   still logged in
root     pts/11       192.168.5.2      Wed Dec  4 15:08   still logged in
root     pts/10       192.168.5.2      Wed Dec  4 15:08   still logged in
root     pts/9        192.168.5.2      Wed Dec  4 13:58   still logged in
root     pts/8        192.168.5.2      Wed Dec  4 13:58   still logged in

last username

指定用户的最近登录信息

[root@localhost ~]# last root
root     pts/12       192.168.5.2      Wed Dec  4 16:42   still logged in
root     pts/2        192.168.5.2      Wed Dec  4 16:34   still logged in
root     pts/0        192.168.5.2      Wed Dec  4 16:34   still logged in
root     pts/11       192.168.5.2      Wed Dec  4 15:08   still logged in
root     pts/10       192.168.5.2      Wed Dec  4 15:08   still logged in
root     pts/9        192.168.5.2      Wed Dec  4 13:58   still logged in
root     pts/8        192.168.5.2      Wed Dec  4 13:58   still logged in
root     pts/7        192.168.5.2      Wed Dec  4 11:37   still logged in

last -n N

最近N条登录信息

[root@localhost ~]# last -n 2
root     pts/12       192.168.5.2      Wed Dec  4 16:42   still logged in
root     pts/2        192.168.5.2      Wed Dec  4 16:34 - 17:09  (00:34)

last rebot

返回系统最近的重启记录

[root@localhost ~]# last rebot

wtmp begins Fri May 31 15:58:22 2024

last shutdown

返回系统最近的关闭记录

[root@localhost ~]# last shutdown

wtmp begins Fri May 31 15:58:22 2024

last -s start_time -t end_time

返回指定时间段内的登录记录