NAME [Toc] [Back]
last, lastb - indicate last logins of users and ttys
SYNOPSIS [Toc] [Back]
/usr/bin/last [-R] [-number] [-x] [-X] [-f file] [name ...] [tty ...]
/usr/bin/lastb [-R] [-number] [-x] [-X] [-f file] [name ...] [tty ...]
DESCRIPTION [Toc] [Back]
The last command searches backwards through the file /var/adm/wtmps
(which contains a record of all logins and logouts) for information
about a user, a tty, or any group of users and ttys. Arguments
specify names of users or ttys of interest. The names of ttys can be
given fully or abbreviated. For example, last 0 is the same as last
tty0. If multiple arguments are given, the information that applies
to any of the arguments is printed. For example, last root console
lists all of root's sessions as well as all sessions on the console
terminal. The last command prints the sessions of the specified users
and ttys, most recent first, indicating when the session began, the
duration of the session, and the tty on which the session took place.
last indicates if the session is still in progress or if it was cut
short by a reboot.
The pseudo-user reboot logs each time the system reboots. Thus, last
reboot is a useful command for evaluating the relative time between
If last is interrupted, it indicates how far the search has progressed
in wtmp. If interrupted by a quit signal (generated by a Ctrl-\),
last indicates how far the search has progressed, then continues the
The lastb command searches backwards through the database file
/var/adm/btmps to display bad login information. Access to
/var/adm/btmps should be restricted to users with appropriate
privileges (owned by and readable only by root) because it may contain
Options [Toc] [Back]
The last and lastb commands recognize the following options and
(none) If no arguments are specified, last prints a record of
all logins and logouts in reverse order, most recent
-R When used with last and lastb, -R displays the user's
host name as it is stored in the files /var/adm/wtmps
and /var/adm/btmps, respectively. The host name is
displayed between the tty name and the user's login
Hewlett-Packard Company - 1 - HP-UX 11i Version 2: August 2003
-number Limits the report to number of lines.
-f file Use file as the name of the accounting file instead of
/var/adm/wtmp or /var/adm/btmp.
-X Use file as the name of the accounting database instead
of /var/adm/wtmps. This option should be used along
with the -f file option.
-x Display the fields in long format if this flag is used
along with the -X flag. Without the -X flag, normal
output is displayed.
AUTHOR [Toc] [Back]
last was developed by the University of California, Berkeley and HP.
FILES [Toc] [Back]
/var/adm/btmp Bad login database
/var/adm/wtmp Login database
/var/adm/wtmps New login database
/var/adm/btmps New bad login database
SEE ALSO [Toc] [Back]
login(1), utmp(4), wtmps(4).
Hewlett-Packard Company - 2 - HP-UX 11i Version 2: August 2003 [ Back ]