NAME

last, lastb − indicate last logins of users and ttys

SYNOPSIS

/etc/last [−c] [−R] [−count] [name ...] [tty ...]
/etc/lastb [−c] [−R] [−count] [name ...] [tty ...]

DESCRIPTION

last searches backwards through file /etc/wtmp (which contains a record of all logins and logouts) for information about a user, a tty, or any group of users and ttys.  Arguments specify names of users or ttys of interest.  Names of ttys can be given fully or abbreviated.  For example, last 0 is the same as last tty0.  If multiple arguments are given, the information that applies to any of the arguments is printed.  For example, last root console lists all of root’s sessions as well as all sessions on the console terminal.  last prints the sessions of the specified users and ttys, most recent first, indicating when the session began, the duration of the session, and the tty on which the session took place.  If the session is still continuing or was cut short by a reboot, last so indicates. 

The pseudo-user reboot logs each time the system reboots.  Thus last reboot is a useful command for evaluating the relative time between system reboots. 

last recognizes the following options and arguments:

(none) If no arguments are specified, last prints a record of all logins and logouts in reverse order, most recent first. 

−c Displays login information for all cnodes of an HP Cluster (see glossary(9)).

−count Limits the report to count lines.  When used in conjunction with the −c option, the limit is applied independently for each cnode in the cluster. 

−R When used with last and lastb, −R displays the user’s host name as it is stored in files /etc/wtmp and /etc/btmp respectively.  The host name is displayed between the tty name and the user’s login time. 

If last is interrupted, it indicates how far the search has progressed in wtmp.  If interrupted by a quit signal (generated by a Ctrl-\), last indicates how far the search has progressed, then continues the search. 

lastb searches backwards through the database file /etc/btmp to display bad login information.  Access to /etc/btmp should be restricted to users with appropriate privileges (owned by and readable only by root) because it may contain password information. 

AUTHOR

last was developed by the University of California, Berkeley and HP. 

FILES

/etc/btmp bad login data base

/etc/wtmp login data base

SEE ALSO

login(1), utmp(4). 

Hewlett-Packard Company  —  HP-UX Release 9.0: August 1992