who [-abdHmqsTu] [file]
who am i
Output list of users logged on, login name, tty name, time of login, and hostname
-a |
/var/run/utmpx
last [-n] [-h host] [-t tty] [user …]
Output sessions of specified users, ttys, and hosts, most recent first.
Each line contains the
user name, the tty from which the session was conducted, any hostname, the start and stop times for the session, and the
duration of the session. If the session is still continuing or was cut short it is flagged
If no users, hostnames or terminals are specified, last prints a record of all logins and logouts (for example over 900 lines!)
-n |
dgerman ttys001 192.168.1.14 Sun May 22 12:10 - 12:14 (00:04) dgerman console Thu Feb 17 20:08 - crash (14+21:55) dgerman ttys001 Thu Feb 17 19:31 - 19:31 (00:00) dgerman ttys000 Mon Jan 31 23:07 - 23:07 (00:00) dgerman console Mon Jan 31 19:08 - 10:37 (10+15:28) over 10 days!If multiple arguments are given, the information which applies to any of the arguments is output, For example:
last root -t
console
would list all of "root's" sessions as well as all sessions on the console terminal.
The pseudo-user reboot
logs in at boots of the system, thus "last reboot" will give an indication of mean time between
boots.
> last shutdown shutdown ~ Mon Jun 6 18:06 shutdown ~ Sun Jun 5 17:43 shutdown ~ Sun Jun 5 16:23 shutdown ~ Sun Jun 5 16:17
r>% last reboot reboot ~ Mon Jun 6 18:07 reboot ~ Mon Jun 6 17:12 reboot ~ Mon Jun 6 17:07 reboot ~ Sun Jun 5 18:17 reboot ~ Sun Jun 5 17:44 reboot ~ Sun Jun 5 16:39 reboot ~ Sun Jun 5 16:24 reboot ~ Sun Jun 5 16:23 reboot ~ Sun Jun 5 16:17
> last _mbsetupuser _mbsetupuser console Sat Dec 25 08:23 - shutdown (03:24) wtmp begins Mon Dec 6 14:25
> last |egrep 'shutdown|boot' reboot ~ Mon Jun 6 18:07 shutdown ~ Mon Jun 6 18:06 dgerman ttys004 Mon Jun 6 17:36 - shutdown (00:29) dgerman ttys003 Mon Jun 6 17:30 - shutdown (00:36) dgerman ttys000 Mon Jun 6 17:28 - shutdown (00:38) dgerman console Mon Jun 6 17:27 - shutdown (00:39) reboot ~ Mon Jun 6 17:12 reboot ~ Mon Jun 6 17:07
If interrupted, it indicates to what date the search has progressed.
If interrupted with a quit signal last indicates how far the search has progressed and then continues.