Linux / 명령어 / last
last 명령어
last 명령어는 최근 로그인 기록을 확인할 때 사용하는 명령어입니다.
/var/log/wtmp 파일을 기반으로 동작합니다. 로그 파일(/var/log/wtmp)가 삭제되면 기록 사라지고, 로그 로테이션에 의해 오래된 기록은 자동 삭제됩니다.
사용법
- 로그인한 사용자, 터미널, 접속 IP, 로그인/로그아웃 시간, 현재 로그인 상태를 보여줍니다.
# last
root pts/0 192.168.0.200 Sat Apr 11 14:23 still logged in
reboot system boot 6.12.0-124.47.1. Sat Apr 11 14:22 still running
reboot system boot 6.12.0-124.47.1. Sat Apr 11 14:22 still running
root tty1 Sat Apr 11 14:21 - 14:22 (00:00)
root pts/0 192.168.0.200 Sat Apr 11 14:15 - 14:22 (00:06)
reboot system boot 6.12.0-124.47.1. Sat Apr 11 14:15 - 14:22 (00:07)
root tty1 Sat Apr 11 14:11 - 14:14 (00:03)
jb tty1 Sat Apr 11 14:10 - 14:11 (00:00)
root pts/0 192.168.0.200 Sat Apr 11 14:09 - 14:14 (00:04)
reboot system boot 6.12.0-124.47.1. Sat Apr 11 14:09 - 14:14 (00:05)
root pts/0 192.168.0.200 Sat Apr 11 14:08 - crash (00:01)
reboot system boot 6.12.0-124.47.1. Sat Apr 11 14:07 - crash (00:02)
root tty1 Sat Apr 11 14:05 - 14:06 (00:00)- 사용자명을 추가하면 특정 사용자의 기록만 볼 수 있습니다.
# last jb
jb tty1 Sat Apr 11 14:44 - 14:45 (00:00)
jb tty1 Sat Apr 11 14:10 - 14:11 (00:00)
jb tty1 Sat Apr 11 14:03 - 14:05 (00:02)- -n 옵션으로 출력할 개수를 정합니다.
# last -n 5
jb tty1 Sat Apr 11 14:44 - 14:45 (00:00)
root pts/0 192.168.0.200 Sat Apr 11 14:23 still logged in
reboot system boot 6.12.0-124.47.1. Sat Apr 11 14:22 still running
reboot system boot 6.12.0-124.47.1. Sat Apr 11 14:22 still running
root tty1 Sat Apr 11 14:21 - 14:22 (00:00)- 날짜를 정하려 출력할 수 있습니다. -s는 시작 날짜, -t는 끝나는 날짜입니다.
# last -s 2026-03-01 -t 2026-03-31
root pts/0 192.168.0.200 Sat Mar 28 12:11 gone - no logout
root tty1 Sat Mar 28 12:00 gone - no logout
reboot system boot 6.12.0-124.40.1. Sat Mar 28 12:00 still running
root pts/0 192.168.0.200 Sat Mar 14 14:19 - 22:51 (08:32)
reboot system boot 6.12.0-124.40.1. Sat Mar 14 14:18 still running
root pts/0 192.168.0.200 Sat Mar 14 14:13 - 14:18 (00:05)
root tty1 Sat Mar 14 14:12 - 14:18 (00:06)
reboot system boot 6.12.0-55.24.1.e Sat Mar 14 14:11 - 14:18 (00:06)- 재부팅 기록을 확인할 수 있습니다.
# last reboot
reboot system boot 6.12.0-124.47.1. Sat Apr 11 14:22 still running
reboot system boot 6.12.0-124.47.1. Sat Apr 11 14:22 still running
reboot system boot 6.12.0-124.47.1. Sat Apr 11 14:15 - 14:22 (00:07)
reboot system boot 6.12.0-124.47.1. Sat Apr 11 14:09 - 14:14 (00:05)
reboot system boot 6.12.0-124.47.1. Sat Apr 11 14:07 - crash (00:02)
reboot system boot 6.12.0-124.40.1. Sat Apr 11 09:22 - 14:06 (04:44)
reboot system boot 6.12.0-124.40.1. Sat Mar 28 12:00 - crash (13+21:22)
reboot system boot 6.12.0-124.40.1. Sat Mar 14 14:18 - crash (13+21:41)
reboot system boot 6.12.0-55.24.1.e Sat Mar 14 14:11 - 14:18 (00:06)도움말
# last -h
Usage:
last [options] [<username>...] [<tty>...]
Show a listing of last logged in users.
Options:
-<number> how many lines to show
-a, --hostlast display hostnames in the last column
-d, --dns translate the IP number back into a hostname
-f, --file <file> use a specific file instead of /var/log/wtmp
-F, --fulltimes print full login and logout times and dates
-i, --ip display IP numbers in numbers-and-dots notation
-n, --limit <number> how many lines to show
-R, --nohostname don't display the hostname field
-s, --since <time> display the lines since the specified time
-t, --until <time> display the lines until the specified time
-T, --tab-separated use tabs as delimiters
-p, --present <time> display who were present at the specified time
-w, --fullnames display full user and domain names
-x, --system display system shutdown entries and run level changes
--time-format <format> show timestamps in the specified <format>:
notime|short|full|iso
-h, --help display this help
-V, --version display version