last(1)

last(1)

NAME

last, lastb - indicate last logins of users and ttys

SYNOPSIS

/usr/bin/last [ -R] [ -number] [ -f®le ] [ name ... ] [ tty ... ]

/usr/bin/lastb [ -R] [ -number] [ -f®le ] [ name ... ] [ tty ... ]

DESCRIPTION

The last command searches backwards through the ®le /var/adm/wtmp (which contains a record of all logins and logouts) for information about a user, a tty, or any group of users and ttys. Arguments specify names of users or ttys of interest. The names of ttys can be given fully or abbreviated. For example, last 0 is the same as last tty0. If multiple arguments are given, the information that applies to any of the arguments is printed. For example, last root console lists all of root's sessions as well as all sessions on the console terminal. The last command prints the sessions of the speci®ed users and ttys, most recent ®rst, indicating when the session began, the duration of the session, and the tty on which the session took place. last indicates if the session is still in progress or if it was cut short by a reboot.

The pseudo-user reboot logs each time the system reboots. Thus, last reboot is a useful command for evaluating the relative time between system reboots.

If last is interrupted, it indicates how far the search has progressed in wtmp. If interrupted by a quit signal (generated by a Ctrl-\), last indicates how far the search has progressed, then continues the search.

The lastb command searches backwards through the database ®le /var/adm/btmp to display bad login information. Access to /var/adm/btmp should be restricted to users with appropriate privileges (owned by and readable only by root) because it may contain password information.

Options

The last and lastb commands recognize the following options and arguments:

(none)

If no arguments are speci®ed, last prints a record of all logins and logouts in reverse

 

order, most recent ®rst.

-R

When used with last and lastb, -Rdisplays the user's host name as it is stored in the

 

®les /var/adm/wtmp and /var/adm/btmp, respectively. The host name is displayed

 

between the tty name and the user's login time.

-numberLimits the report to number of lines.

-ffile Use ®le as the name of the accounting ®le instead of /var/adm/wtmp or

/var/adm/btmp .

AUTHOR

last was developed by the University of California, Berkeley and HP.

FILES

/var/adm/btmp Bad login database /var/adm/wtmp Login database

SEE ALSO login(1), utmp(4).

l

HP-UX Release 11i: December 2000

− 1 −

Section 1−421