Shulou(Shulou.com)06/02 Report--

Preface

This article mainly introduces the relevant content about the usage of the common command last in Linux, and shares it for your reference and study. Without saying much, let's take a look at the detailed introduction.

Brief introduction to the command:

This command is used to list information about users who have logged in to the system in the past. Original meaning of instruction: show listing of last logged in users

Execution permissions: some require special permissions

Path where the instruction is located: / usr/bin/last

When the last instruction is executed, it reads the file named wtmp in the / var/log directory and displays the full list of users logged in to the system for the contents of the file. The default is to display wtmp records, btmp can display in more detail, you can display remote login, such as ssh login.

What is saved in the utmp file is the information of the users currently in the system.

What is saved in the wtmp file is the information of users who have logged in to the system.

Description of the command output field:

First column: user name

Second column: terminal location. Pts/0 (pseudo terminal) means a user connected remotely from a remote connection such as SSH or telnet. Tty (teletypewriter) means a user connected directly to a computer or locally connected.

The third column: log in to ip or kernel. If you see: 0.0 or nothing, this means that the user connects through the local terminal. In addition to the restart activity, the kernel version is displayed in the state.

Column 4: start time

Fifth column: end time (still login in has not exited down until normal shutdown crash until forced shutdown)

Column 6: duration

Command syntax:

Last [- R] [- num] [- n num] [- adiowx] [- f file] [- t YYYYMMDDHHMMSS] [name...] [tty...]

Command parameters:

Parameters.

Long parameter

Description

-a

The host name or IP address of the login system is displayed on the last line

-d

Translate IP addresses to host names

-f

Specify the record file. The default is to display the records of the wtmp file in the / var/log directory, but the btmp in the / var/log directory can display more content, and can display remote login, such as ssh login, including failed login requests.

-I

-I shows the login of a specific ip. The trace uses-I to show specific ip logins. For tracking

-o

Read an old-type wtmp file (written by linux-libc5 applications).

-n

-n or-sets how many rows of records are displayed

-w

Display full user and domain names in the output

-R

Do not display the host name or IP of the logged in system (omit the field of hostname)

-t

Display information before YYYYMMDDHHMMSS

-x

Displays the history of system shutdown, user login, and logout

Examples of use:

1: view help information for the last command

[root@DB-Server ~] # man last [root@DB-Server ~] # last-hlast: invalid option-- hUsage: last [- num |-n num] [- f file] [- t YYYYMMDDHHMMSS] [- R] [- x] [- o] [- w] [username..] [tty..]

2: displays the N records that last logged into the system

[root@DB-Server] # last-10root pts/1: 0.0 Wed Dec 18 09:54 still logged in root pts/4: 0.0 Wed Dec 18 09:43-09:48 (00:04) root pts/1: 0.0 Wed Dec 18 09:43-09:48 (00:05) root pts/3 192.168.103.79 Wed Dec 18 09 Wed Dec 41-12 Wed Dec 40 (02 Wed Dec 59) root pts/4: 0.0 Wed Dec 18 0915 28-09 Wed Dec 30 (00) : 01) root pts/3: 0.0 Wed Dec 18 09:27-09:30 (00:02) root pts/2 192.168.103.29 Wed Dec 18 09:27 still logged in root pts/1: 0.0 Wed Dec 18 09:27-09:42 (00:15) root pts/2: 0.0 Wed Dec 18 09 root pts/2 23-09 wtmp begins Wed Dec 25 (00 wtmp begins Wed Dec) 11 03:02:17 2013 [root@DB-Server ~] # last-n 10root pts/1: 0.0 Wed Dec 18 09:54 still logged in root pts/4: 0.0 Wed Dec 18 09:43-09:48 (00:04) root pts/1: 0.0 Wed Dec 18 09:43-09:48 (00:05) root pts/3 192.168.103.79 Wed Dec 18 09 Wed Dec 41-12 Wed Dec 40 (02 Wed Dec 59) root pts/4: 0.0 Wed Dec 18 09 : 28-09:30 (00:01) root pts/3: 0.0 Wed Dec 18 09:27-09:30 (00:02) root pts/2 192.168.103.29 Wed Dec 18 09:27 still logged in root pts/1: 0.0 Wed Dec 18 09:27-09 Wed Dec 42 (00 Wed Dec 15) root pts/2: 0.0 Wed Dec 18 09 root pts/2 23-09 25 (00 Wed Dec 18 09 root pts/2 22-09 root pts/2 25 (00) : 02) wtmp begins Wed Dec 11 03:02:17 2013

3: display the hostname or IP address of the logged in system on the last line

[root@DB-Server ~] # last-10-aroot pts/1 Wed Dec 18 09:54 still logged in: 0.0root pts/4 Wed Dec 18 09:43-09:48 (00:04): 0.0root pts/1 Wed Dec 18 09:43-09:48 (00:05): 0.0root pts/3 Wed Dec 1809 aroot pts/1 Wed Dec 41-12 40 (02 still logged in 59) 192.168.103.79root pts/4 Wed Dec 18 09 root@DB-Server 28-09 30 (0001) : 0.0root pts/3 Wed Dec 18 09:27-09:30 (00:02): 0.0root pts/2 Wed Dec 18 09:27 still logged in 192.168.103.29root pts/1 Wed Dec 18 09:27-09:42 (00:15): 0.0root pts/2 Wed Dec 1809 still logged in 192.168.103.29root pts/1 Wed Dec 23-09 still logged in 192.168.103.29root pts/1 Wed Dec 25 (00 still logged in 192.168.103.29root pts/1 Wed Dec 01): 0.0root pts/1 Wed Dec 18 09 still logged in 192.168.103.29root pts/1 Wed Dec 22-09 still logged in 192.168.103.29root pts/1 Wed Dec 25 (00 still logged in 192.168.103.29root pts/1 Wed Dec 02): 0.0 00 11 03:02:17 2013

4: the host name or IP address logged in to the system is not displayed

[root@DB-Server] # last-10-Rroot pts/1 Wed Dec 18 09:54 still logged in root pts/4 Wed Dec 18 09:43-09:48 (00:04) root pts/1 Wed Dec 18 09:43-09:48 (00:05) root pts/3 Wed Dec 18 09 root pts/1 Wed Dec 41-12 still logged in root pts/4 Wed Dec 41-12 root pts/4 Wed Dec 18 09 root pts/4 Wed Dec 28-09 root@DB-Server 28-09 root pts/3 Wed Dec 27-09 Rroot pts/1 Wed Dec 30 ) root pts/2 Wed Dec 18 09:27 still logged in root pts/1 Wed Dec 18 09:27-09:42 (00:15) root pts/2 Wed Dec 18 09:23-09:25 (00:01) root pts/1 Wed Dec 18 09 root pts/2 Wed Dec 22-09 wtmp begins Wed Dec 11 03:02:17 2013

5: specify the / var/log/btmp file to view the user information logged in to the system

[root@DB-Server] # last-n 10-f / var/log/btmproot ssh:notty 192.168.136.163 Fri Oct 17 18:16 gone-no logout root ssh:notty 192.168.136.163 Fri Oct 17 09:50-18:16 (08:26) root ssh:notty 192.168.136.163 Fri Oct 17 09:50-09:50 (00:00) root ssh:notty 192.168.40.218 Tue Jul 23 17 root Ssh:notty 192.168.236.149 Sun Apr 14 01:34-17:40) root ssh:notty 192.168.178.147 Fri Mar 8 17:25-01:34 (360.08 Fri Mar 08) tomcat ssh:notty get185806.gfg1.e Fri Oct 26 16:48-17:25 (133pm tomcat ssh:notty get185806.gfg1.e Fri Oct 37) root ssh:notty 192.168.193.3 Mon Oct 22 1813-16 root ssh:notty 192.168.193.3 Mon Oct 22 1813-18 : 13 (00:00) devloper ssh:notty get185819.gfg1.e Wed Oct 17 17:22-18:13 (500 50) btmp begins Thu Apr 12 14:30:06 2012

6: convert IP address to host name

Last-10-d

7: display information before YYYYMMDDHHMMSS (20150110093000)

[root@DB-Server] # last-10-t 20150110093000root pts/2 192.168.102.186 Fri Jan 9 15:35-17:27 (01:52) root pts/2 192.168.102.134 Thu Jan 8 10:25-12:27 (02:02) root pts/3 192.168.125.53 Tue Jan 6 23:59-0020150110093000root pts/2 09 (0020150110093000root pts/2 09) root pts/2 192.168.125.53 Tue Jan 62345 root pts/2 09 (0020150110093000root pts/2 23) root pts / 3 192.168.102.88 Tue Jan 6 15:23-16:20 (00:57) root pts/2 192.168.102.88 Tue Jan 6 15:08-17:25 (02:16) oracle pts/1: 2.0 Tue Jan 6 15:07 still logged in reboot system boot 2.6.32-200.13.1. Tue Jan 6 15:07 (7 days 20 Tue Jan 21) root pts/2 192.168.102.88 Tue Jan 6 14:47-down (00:17) oracle pts/1: 2.0 Tue Jan 6 14:46-down (00:18) wtmp begins Wed Apr 11 16:31:10 2012

Summary

The above is the whole content of this article, I hope that the content of this article can bring some help to your study or work, if you have any questions, you can leave a message and exchange, thank you for your support.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.