who

users logged on, login name, tty , time of login, and hostname

last

who [-abdHmqsTu] [file]

who am i

Output list of users logged on, login name, tty name, time of login, and hostname

-a Same as -bdlprTtu
-T + terminal is writable;- not.
-H Include heading
who -aH
> who -THa
USER     S LINE     WHEN         IDLE      PID  COMMENT
reboot   - ~        Jun  6 18:07 00:08       1
dgerman  - console  Jun  6 18:07  old      162
dgerman  + ttys000  Jun  7 15:49 06:38    4785
dgerman  + ttys001  Jun  7 16:46 19:18    5204
dgerman  + ttys002  Jun  7 12:09   .      4329
dgerman  + ttys003  Jun  7 16:13 06:35    4946
   .       run-level 3

-s Only the name, line and time fields. the default.
-m Only about the current terminal.
-q "Quick mode": only names and number of users currently logged on, Other options are ignored.
-b Time of last system boot.
-u idle time for each user, and the associated process ID.
am I the invoker's real user name.
-d Print dead processes.
file Default /var/run/utmpx.

Files

/var/run/utmpx

See

last(1), mesg(1), users(1), getuid(2), utmpx(5)


last

indicate last logins of users and ttys

last [-n] [-h host] [-t tty] [user]

Output sessions of specified users, ttys, and hosts, most recent first.
Each line contains the user name, the tty from which the session was conducted, any hostname, the start and stop times for the session, and the duration of the session. If the session is still continuing or was cut short it is flagged

If no users, hostnames or terminals are specified, last prints a record of all logins and logouts (for example over 900 lines!)

-n Limits the report to n lines for default with no names.
-h host names or numbers.
-t [tty]nn tty names may be abbreviated, for example, "last -t 03" is equivalent to "last -t tty03".

dgerman   ttys001  192.168.1.14     Sun May 22 12:10 - 12:14  (00:04)
dgerman   console                   Thu Feb 17 20:08 - crash (14+21:55)
dgerman   ttys001                   Thu Feb 17 19:31 - 19:31  (00:00)
dgerman   ttys000                   Mon Jan 31 23:07 - 23:07  (00:00)
dgerman   console                   Mon Jan 31 19:08 - 10:37 (10+15:28)  over 10 days!

If multiple arguments are given, the information which applies to any of the arguments is output, For example: last root -t console would list all of "root's" sessions as well as all sessions on the console terminal.

The pseudo-user reboot logs in at boots of the system, thus "last reboot" will give an indication of mean time between boots.

> last  shutdown 
shutdown  ~                         Mon Jun  6 18:06 
shutdown  ~                         Sun Jun  5 17:43 
shutdown  ~                         Sun Jun  5 16:23 
shutdown  ~                         Sun Jun  5 16:17 
r>% last  reboot  
reboot    ~                         Mon Jun  6 18:07 
reboot    ~                         Mon Jun  6 17:12 
reboot    ~                         Mon Jun  6 17:07 
reboot    ~                         Sun Jun  5 18:17 
reboot    ~                         Sun Jun  5 17:44 
reboot    ~                         Sun Jun  5 16:39 
reboot    ~                         Sun Jun  5 16:24 
reboot    ~                         Sun Jun  5 16:23 
reboot    ~                         Sun Jun  5 16:17 
>  last _mbsetupuser
_mbsetupuser  console                   Sat Dec 25 08:23 - shutdown  (03:24)

wtmp begins Mon Dec  6 14:25 
> last |egrep 'shutdown|boot'
reboot    ~                         Mon Jun  6 18:07 
shutdown  ~                         Mon Jun  6 18:06 
dgerman   ttys004                   Mon Jun  6 17:36 - shutdown  (00:29)
dgerman   ttys003                   Mon Jun  6 17:30 - shutdown  (00:36)
dgerman   ttys000                   Mon Jun  6 17:28 - shutdown  (00:38)
dgerman   console                   Mon Jun  6 17:27 - shutdown  (00:39)
reboot    ~                         Mon Jun  6 17:12 
reboot    ~                         Mon Jun  6 17:07 

If interrupted, it indicates to what date the search has progressed.
If interrupted with a quit signal last indicates how far the search has progressed and then continues.