3 last

last looks through the wtmp file (which records all logins/logouts) and prints information about connect times of users. Records are printed from most recent to least recent. Records can be specified by tty and username. tty names can be abbreviated: `last 0' is equivalent to `last tty0'.

Multiple arguments can be specified: `last root console' will print all of the entries for the user root and all entries logged in on the console tty.

The special users reboot and shutdown log in when the system reboots or (surprise) shuts down. `last reboot' will produce a record of reboot times.

If last is interrupted by a quit signal, it prints out how far its search in the wtmp file had reached and then quits:

     weerapan  ttyq6    132.162.32.37    Mon Feb 15 19:07 - 19:21  (00:13)
     weerapan  ttyq6    132.162.32.37    Mon Feb 15 19:07 - 19:21  (00:13)
     
     interrupted at Mon Feb 15 19:07:52 1993

3.1 Flags

This program implements the features of regular u*x last with a few extra flags. When last is invoked with no arguments, the output looks like this:

     gr151     ttyp2    ray.cs.oberlin.e Tue Feb 16 17:40   still logged in
     jhoggard  ttyp2    csts.cs.oberlin. Tue Feb 16 17:39 - 17:39  (00:00)
     jstarr    ttyp1    UNIX5.ANDREW.CMU Tue Feb 16 17:38   still logged in
     jberman   ttypb    132.162.32.25    Tue Feb 16 17:34   still logged in
     alee      ttyp7    csts.cs.oberlin. Tue Feb 16 17:34   still logged in
     jbrick    ttyp2    ocvaxa.cc.oberli Tue Feb 16 17:33 - 17:36  (00:03)
     mbastedo  ttypc    ocvaxa.cc.oberli Tue Feb 16 17:25 - 17:26  (00:01)
     rgoodste  ttypb    ocvaxa.cc.oberli Tue Feb 16 17:22 - 17:26  (00:03)
     huttar    ttyp9    lobby.ti.com     Tue Feb 16 17:19   still logged in
     klutz     ttyp3    132.162.32.25    Tue Feb 16 17:14   still logged in

--no-truncate-ftp-entries

When printing out the information, don't chop the number part off of ftpxxxx entries.

-number

-n number

--lines number

Limit the number of lines that last prints.

-f filename

--file filename

Read from the file filename instead of the system's wtmp file.

-y

--print-year

Print out the year when displaying dates.

-s

--print-seconds

Print out seconds when displaying dates and durations.

--complain

When the wtmp file has a problem (a time-warp, missing record, or whatever), print out an appropriate error.

-x

--more-records

Print out run level changes, shutdowns, and time changes in addition to the normal records.

-a

--all-records

Print out all records in the wtmp file.

-i

--ip-address

Some machines store the IP address of a connection in a utmp record. Enabling this option makes last print the IP address instead of the hostname.

--tw-leniency value

Set the time warp leniency value (in seconds). See the ac chapter for information.

--tw-suspicious value

Set the time warp suspicious value (in seconds). See the ac chapter for information.

-w

--wide

By default, last tries to print each entry within in 80 columns. Use this option to instruct last to print out the fields in the wtmp file with full field widths.

--debug

Print verbose internal information.

-V

--version

Print last's version number.

-h

--help

Print last's usage string and default locations of system files to standard output.

3.2 Problems

The Clock Change Problem

Of the lasts I've tried, all of them have had problems parsing a system clock change. Instead of modifying the entries that have been read, they just ignore the change and give you incorrect values. GNU last knows about clock changes and prints the correct times.

TANGIBLE RESULT: if you diff the output of your last and GNU last, entries after (before, rather) a clock change will be off by the amount of the clock change.

The Ftp Problem

Most lasts that I've examined have the same problem here as ac does—they log everyone out as soon as they see an ftp entry.

TANGIBLE RESULT: GNU last will reflect the correct time spent in an ftp session, so the totals that it gives will most likely be greater than those given by the system last.