一、说明
last 命令用来列出现在和过去登录过系统的用户信息。
执行last指令时,会读取位于/var/log/wtmp 的文件,并把该给文件的内容记录的登录系统的用户名单全部显示出来。
/var/log/btmp 文件可以显示的更详细,可以显示远程登录,例如ssh登录。
/var/log/utmp 文件中保存的是当前正在本系统中的用户的信息。
/var/log/wtmp 文件中保存的是登录过本系统的用户的信息。
lastb 显示用户登录失败的记录信息。选项参数和 last 命令一致。
[root@cenos79 ~]# last
root pts/2 192.168.1.123 Fri Jul 30 15:38 still logged in
root pts/0 192.168.1.123 Fri Jul 30 10:32 still logged in
root pts/2 192.168.1.123 Thu Jul 29 19:08 - 00:25 (05:16)
root pts/3 192.168.1.123 Thu Jul 29 13:54 - 19:08 (05:13)
root pts/0 192.168.1.123 Thu Jul 29 13:54 - 00:25 (10:31)
root pts/2 192.168.1.123 Thu Jul 29 11:24 - 16:04 (04:39)
root pts/0 192.168.1.123 Thu Jul 29 11:20 - 13:53 (02:33)
root pts/2 192.168.1.123 Wed Jul 28 15:12 - 22:01 (06:49)
root pts/0 192.168.1.123 Wed Jul 28 09:39 - 15:39 (06:00)
root pts/0 192.168.1.123 Tue Jul 27 17:38 - 06:41 (13:02)
1 2 3 4 5 6
说明:
1、登录的用户名称。
2、终端位置。pts/0 (伪终端) 意味着从诸如SSH或telnet的远程连接的用户.tty (teletypewriter) 意味着直接连接到计算机或者本地连接的用户
3、登录ip或者内核 。如果你看见:0.0 或者什么都没有,这意味着用户通过本地终端连接。除了重启活动,内核版本会显示在状态中。
4、开始时间
5、结束时间(still login in 还未退出 down 直到正常关机 crash 直到强制关机)
6、持续时间
显示指定用户登录的信息记录。
[root@centos76 ~]# last -5 root ## 显示指定的用户登录信息
root pts/0 192.168.52.128 Fri Jul 30 16:27 still logged in
root pts/1 192.168.52.128 Sat Jul 24 18:47 - 18:47 (00:00)
root pts/0 192.168.52.128 Sat Jul 24 18:28 - 22:38 (04:10)
root pts/0 :0 Sat Jul 24 18:27 - 18:28 (00:00)
root :0 :0 Sat Jul 24 18:27 still logged in
wtmp begins Thu May 20 16:56:18 2021
二、选项参数
1、-a 将登录系统的的主机名称或IP地址,显示在最后一行
[root@cenos79 ~]# last -a
root pts/2 Fri Jul 30 15:38 still logged in 192.168.1.123
root pts/0 Fri Jul 30 10:32 still logged in 192.168.1.123
root pts/2 Thu Jul 29 19:08 - 00:25 (05:16) 192.168.1.123
root pts/3 Thu Jul 29 13:54 - 19:08 (05:13) 192.168.1.123
root pts/0 Thu Jul 29 13:54 - 00:25 (10:31) 192.168.1.123
2、-n 设置显示多少行记录
[root@cenos79 ~]# last -n 3
root pts/2 192.168.1.123 Fri Jul 30 15:38 still logged in
root pts/0 192.168.1.123 Fri Jul 30 10:32 still logged in
root pts/2 192.168.1.123 Thu Jul 29 19:08 - 00:25 (05:16)
wtmp begins Thu Jul 11 11:10:20 2019
或
[root@cenos79 ~]# last -3
root pts/2 192.168.1.123 Fri Jul 30 15:38 still logged in
root pts/0 192.168.1.123 Fri Jul 30 10:32 still logged in
root pts/2 192.168.1.123 Thu Jul 29 19:08 - 00:25 (05:16)
wtmp begins Thu Jul 11 11:10:20 2019
[root@cenos79 ~]#
3、-x 显示系统关闭、用户登录或退出的历史记录信息。
[root@cenos79 ~]# last -x
root pts/0 192.168.1.123 Fri Dec 6 13:09 - 21:53 (08:44)
runlevel (to lvl 3) 3.10.0-957.21.3. Fri Dec 6 13:08 - 16:01 (602+02:52)
reboot system boot 3.10.0-957.21.3. Fri Dec 6 21:08 - 16:01 (601+18:52)
runlevel (to lvl 3) 3.10.0-957.21.3. Fri Dec 6 12:52 - 13:08 (00:16)
reboot system boot 3.10.0-957.21.3. Fri Dec 6 20:52 - 16:01 (601+19:09)
shutdown system down 3.10.0-957.21.3. Thu Jul 11 11:10 - 20:52 (148+09:41)
wtmp begins Thu Jul 11 11:10:20 2019
4、-R 不显示登录系统用户的主机名或IP地址。
[root@cenos79 ~]# last -5 -R
root pts/2 Fri Jul 30 15:38 still logged in
root pts/0 Fri Jul 30 10:32 still logged in
root pts/2 Thu Jul 29 19:08 - 00:25 (05:16)
root pts/3 Thu Jul 29 13:54 - 19:08 (05:13)
root pts/0 Thu Jul 29 13:54 - 00:25 (10:31)
wtmp begins Thu Jul 11 11:10:20 2019
[root@cenos79 ~]#
5、-t 显示YYYYMMDDHHMMSS之前的信息
[root@cenos79 ~]# last -5 -t 20201122091030 ## 显示2020年11月22号09:10:30之前的登录信息。
root pts/0 192.168.1.123 Tue Sep 1 22:18 - 22:21 (00:03)
root pts/2 192.168.1.123 Mon Aug 31 23:17 - 01:43 (02:25)
root pts/2 192.168.1.123 Mon Aug 31 23:08 - 23:16 (00:07)
root pts/1 192.168.1.123 Mon Aug 31 23:03 - 01:43 (02:40)
root pts/0 192.168.1.123 Mon Aug 31 22:35 - 01:09 (02:33)
wtmp begins Thu Jul 11 11:10:20 2019
[root@cenos79 ~]#
6、-i 这个选项类似于显示远程主机 IP 地址(IP number)的 -d 选项,只不过它用数字和点符号显示IP数
[root@centos76 ~]# last -i root
root pts/0 192.168.52.128 Fri Jul 30 16:27 still logged in
root pts/1 192.168.52.128 Sat Jul 24 18:47 - 18:47 (00:00)
root pts/0 192.168.52.128 Sat Jul 24 18:28 - 22:38 (04:10)
root pts/0 0.0.0.0 Sat Jul 24 18:27 - 18:28 (00:00)
root :0 0.0.0.0 Sat Jul 24 18:27 still logged in
root pts/0 192.168.52.128 Thu Jul 22 11:39 - 22:53 (11:14)
last -i 和 last的区别
[root@centos76 ~]# last
root pts/0 192.168.52.128 Fri Jul 30 16:27 still logged in
root pts/1 192.168.52.128 Sat Jul 24 18:47 - 18:47 (00:00)
root pts/0 192.168.52.128 Sat Jul 24 18:28 - 22:38 (04:10)
root pts/0 :0 Sat Jul 24 18:27 - 18:28 (00:00)
root :0 :0 Sat Jul 24 18:27 still logged in
root pts/0 192.168.52.128 Thu Jul 22 11:39 - 22:53 (11:14)
root pts/0 192.168.52.128 Wed Jul 21 15:10 - 19:20 (04:09)
7、-d 将IP地址转换成主机名称。
对于非本地的登录,Linux 不仅保存远程主机名而且保存IP地址(IP number)。这个选项可以将IP地址(IP number)转换为主机名。
[root@cenos79 ~]# last -5 -d
root pts/2 test Fri Jul 30 15:38 still logged in
root pts/0 test Fri Jul 30 10:32 still logged in
root pts/2 test Thu Jul 29 19:08 - 00:25 (05:16)
root pts/3 test Thu Jul 29 13:54 - 19:08 (05:13)
8、-f 指定记录文件,默认是显示/var/log目录下的wtmp文件的记录,但/var/log目录下得btmp能显示的内容更丰富,可以显示远程登录,例如ssh登录 ,包括失败的登录请求。
[root@cenos79 ~]# last -10 -f /var/log/btmp
user2 ssh:notty 192.168.52.128 Fri Jul 30 16:42 gone - no logout
user2 ssh:notty 192.168.52.128 Fri Jul 30 16:42 - 16:42 (00:00)
oracle ssh:notty 192.168.52.128 Fri Jul 30 16:17 - 16:42 (00:24)
oracle ssh:notty 192.168.52.128 Fri Jul 30 16:17 - 16:17 (00:00)
oracle ssh:notty 192.168.52.128 Fri Jul 30 15:40 - 16:17 (00:37)
oracle ssh:notty 192.168.52.128 Fri Jul 30 15:40 - 15:40 (00:00)
eshare ssh:notty 192.168.52.128 Fri Jul 30 14:42 - 15:40 (00:57)
eshare ssh:notty 192.168.52.128 Fri Jul 30 14:42 - 14:42 (00:00)
eshare ssh:notty 192.168.52.128 Fri Jul 30 14:08 - 14:42 (00:34)
eshare ssh:notty 192.168.52.128 Fri Jul 30 14:08 - 14:08 (00:00)
btmp begins Thu Jul 1 11:16:44 2021