Read the wtmp database to display past logins, logouts, reboots, and related records in reverse chronological order.
Do not limit the result to current sessions.
Which command is appropriate?
last reads /var/log/wtmp by default and displays historical login, logout, and reboot records. who and w show current sessions instead.
Detailed explanation
whoIncorrect. who shows current login sessions.
Incorrect. who shows current login sessions.
wIncorrect. w shows current users and activity.
Incorrect. w shows current users and activity.
lastCorrect. It displays historical login and related records.
Correct. It displays historical login and related records.
usersIncorrect. users displays only current logged-in names.
Incorrect. users displays only current logged-in names.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s
' 'last -> wtmp login/logout/reboot history'Expected result
last -> wtmp login/logout/reboot historyKey points
- Read wtmp
- Show historical records
- Distinguish who and w
Notes
- Environment: util-linux lastの動作対応表
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.