Linux last Guide

Complete beginner-friendly guide to last on Linux, covering Arch Linux, CachyOS, and other distributions including login history, system reboots, and user activity logs.

---

Table of Contents

1. Understanding last
2. last Basics
3. Login History
4. System Reboots
5. Troubleshooting

---

Understanding last

What is last?

last shows login history.

Uses:

• Login history: See past logins
• Reboot history: System reboots
• User activity: Track user logins
• Security audit: Review access

Why it matters:

• Security: Monitor access
• Troubleshooting: Debug login issues
• Audit: Track system usage

---

last Basics

View History

Show logins:

# Show login history
last

# Shows:
# - Username
# - Terminal
# - Login time
# - Logout time
# - Duration

Specific User

User history:

# Show user logins
last username

# Show root logins
last root

---

Login History

Recent Logins

Limit output:

# Show last 10 logins
last -n 10

# Or
last | head -10

Since Date

Time range:

# Show since date
last -s 2024-01-01

# Show until date
last -t 2024-01-31

---

System Reboots

Reboot History

System reboots:

# Show reboots
last reboot

# Show shutdowns
last shutdown

Boot Information

Boot details:

# Show with details
last -F reboot

# Full timestamp format

---

Troubleshooting

last Not Found

Check installation:

# Check last
which last

# Usually in util-linux
# Install if missing
sudo pacman -S util-linux

No History

Check logs:

# Check wtmp
ls -la /var/log/wtmp

# Check utmp
ls -la /var/run/utmp

---

Summary

This guide covered last usage, login history, and system reboot tracking for Arch Linux, CachyOS, and other distributions.

---

Next Steps

• who Guide - Current users
• w Guide - User activity
• Log Management - System logs
• last Documentation: man last

---

This guide covers Arch Linux, CachyOS, and other Linux distributions. For distribution-specific details, refer to your distribution's documentation.