GNU Info

(accounting.info)last

---

Next: lastcomm Prev: accton Up: Top

---

Enter node , (file) or (file)node

`last'
******

   `last' looks through the `wtmp' file (which records all
logins/logouts) and prints information about connect times of users.
Records are printed from most recent to least recent.  Records can be
specified by tty and username.  tty names can be abbreviated: `last 0'
is equivalent to `last tty0'.

   Multiple arguments can be specified: `last root console' will print
all of the entries for the user `root' and all entries logged in on the
`console' tty.

   The special users `reboot' and `shutdown' log in when the system
reboots or (surprise) shuts down.  `last reboot' will produce a record
of reboot times.

   If `last' is interrupted by a quit signal, it prints out how far its
search in the `wtmp' file had reached and then quits:
     weerapan  ttyq6    132.162.32.37    Mon Feb 15 19:07 - 19:21  (00:13)
     weerapan  ttyq6    132.162.32.37    Mon Feb 15 19:07 - 19:21  (00:13)
     
     interrupted at Mon Feb 15 19:07:52 1993

Flags
=====

   This program implements the features of regular u*x `last' with a few
extra flags.  When `last' is invoked with no arguments, the output
looks like this:
     gr151     ttyp2    ray.cs.oberlin.e Tue Feb 16 17:40   still logged in
     jhoggard  ttyp2    csts.cs.oberlin. Tue Feb 16 17:39 - 17:39  (00:00)
     jstarr    ttyp1    UNIX5.ANDREW.CMU Tue Feb 16 17:38   still logged in
     jberman   ttypb    132.162.32.25    Tue Feb 16 17:34   still logged in
     alee      ttyp7    csts.cs.oberlin. Tue Feb 16 17:34   still logged in
     jbrick    ttyp2    ocvaxa.cc.oberli Tue Feb 16 17:33 - 17:36  (00:03)
     mbastedo  ttypc    ocvaxa.cc.oberli Tue Feb 16 17:25 - 17:26  (00:01)
     rgoodste  ttypb    ocvaxa.cc.oberli Tue Feb 16 17:22 - 17:26  (00:03)
     huttar    ttyp9    lobby.ti.com     Tue Feb 16 17:19   still logged in
     klutz     ttyp3    132.162.32.25    Tue Feb 16 17:14   still logged in

`--no-truncate-ftp-entries'
     When printing out the information, don't chop the number part off
     of `ftp'XXXX entries.

`-NUMBER'
`-n NUMBER'
`--lines NUMBER'
     Limit the number of lines that `last' prints.

`-f FILENAME'
`--file FILENAME'
     Read from the file FILENAME instead of the system's `wtmp' file.

`-y'
`--print-year'
     Print out the year when displaying dates.

`-s'
`--print-seconds'
     Print out seconds when displaying dates and durations.

`--complain'
     When the `wtmp' file has a problem (a time-warp, missing record,
     or whatever), print out an appropriate error.

`-x'
`--more-records'
     Print out run level changes, shutdowns, and time changes in
     addition to the normal records.

`-a'
`--all-records'
     Print out all records in the `wtmp' file.

`-i'
`--ip-address'
     Some machines store the IP address of a connection in a utmp
     record.  Enabling this option makes `last' print the IP address
     instead of the hostname.

`--tw-leniency VALUE'
     Set the time warp leniency value (in seconds).  See the `ac'
     chapter for information.

`--tw-suspicious VALUE'
     Set the time warp suspicious value (in seconds).  See the `ac'
     chapter for information.

`-w'
`--wide'
     By default, `last' tries to print each entry within in 80 columns.
     Use this option to instruct `last' to print out the fields in the
     `wtmp' file with full field widths.

`--debug'
     Print verbose internal information.

`-V'
`--version'
     Print `last''s version number.

`-h'
`--help'
     Print `last''s usage string and default locations of system files
     to standard output.

Problems
========

The Clock Change Problem
........................

   Of the `last's I've tried, all of them have had problems parsing a
system clock change.  Instead of modifying the entries that have been
read, they just ignore the change and give you incorrect values.  GNU
`last' knows about clock changes and prints the correct times.

*TANGIBLE RESULT:* if you `diff' the output of your `last' and GNU
`last', entries after (before, rather) a clock change will be off by
the amount of the clock change.

The Ftp Problem
...............

   Most `last's that I've examined have the same problem here as `ac'
does--they log everyone out as soon as they see an ftp entry.

*TANGIBLE RESULT:* GNU `last' will reflect the correct time spent in an
ftp session, so the totals that it gives will most likely be greater
than those given by the system `last'.