[ Previous | Next | Table of Contents | Index | Library Home | Legal | Search ]

Commands Reference, Volume 3

last Command


Displays information about previous logins.


last [ -f FileName ] [ -Number ] [ Name ... ] [ Terminal ... ]


The last command displays, in reverse chronological order, all previous logins and logoffs still recorded in the /var/adm/wtmp file. The /var/adm/wtmp file collects login and logout records as these events occur and holds them until the records are processed by the acctcon1 and acctcon2 commands as part of the daily reporting procedures. When the time daemon, timed, changes the system time, it logs entries in wtmp under the pseudo-user "date". An entry starting with "date |" is logged before the change, and one starting with "date {" is logged after the change. This allows for accurate accounting of logins that span a time change.

The list can be restricted to:

For each process, the last command displays the:

If applicable, the following information is included:

If the last command is interrupted, it indicates how far the search has progressed in the /var/adm/wtmp file. If interrupted with a quit signal, the command indicates how far the search has progressed and then continues the search. The quit signal can be any one of the following:

#define SIGQUIT 3 /* (*) quit, 
generated from terminal special char */
#define SIGKILL 9 /* kill (cannot be caught or ignored) */
#define SIGTERM 15 /* software termination signal */

The kill command sends the default SIGTERM signal when it is invoked without any option. If you want to send the SIGQUIT signal, enter the following:

kill -3 (Process ID)

See the kill command for more information.


-f FileName Specifies an alternate file from which to read logins and logoffs.


  1. To display all the recorded logins and logoffs by user root or from the console terminal, enter:

    last root console
  2. To display the time between reboots of the system, enter:

    last reboot

    The reboot pseudo-user logs in when the system starts again.


/usr/bin/last Contains the last command.
/var/adm/wtmp Contains connect-time accounting data, including login, logoff, and shutdown records.

Related Information

The acctcon1 , accton2 command, lastlogin command.

For more information about the Accounting System, the preparation of daily and monthly reports, and the accounting files, see the Accounting Overview in AIX 5L Version 5.1 System Management Concepts: Operating System and Devices.

Setting Up an Accounting System in AIX 5L Version 5.1 System Management Guide: Operating System and Devices describes the steps you must take to establish an accounting system.

[ Previous | Next | Table of Contents | Index | Library Home | Legal | Search ]