How to use who/last Command in Linux/Centos

Following are the basic user monitor commands:

  • who
  • last

1. who command:

As a Linux user, sometimes it is required to know some basic information like: 

  • Time of last system boot 
  • List of users logged-in 
  • Current run level etc 

Though this type of information can be obtained from various files in the Linux system but there is a command line utility ‘who’ that does exactly the same for you. In this article, we will discuss the capabilities and features provided by the command ‘who’.

Syntax:

# who [OPTION]... [ FILE | ARG1 ARG2 ]

Examples of ‘who’ command

1. Get the information on currently logged in users

This is done by simply running the ‘who’ command (without any options). Consider the following example which shows the current logged-in users.

$ who
root pts/0        2020-05-06 09:55  05:33 (:0)
technicalmint pts/0    2020-05-06  06:47 (:0.0)

unix101 pts/2     2020-05-06 07:58 (:0.0)

2. Get the time of last system boot

The is done using the -b option. Example below: 

# who -b
system boot  2020-05-02 11:24

We can see that the above output gives the exact date and time of last system boot.

3. Get information on system login processes

This is done using the -l option. Example below:

# who -l
LOGIN    tty1         2020-05-02 11:24              1129 id=tty1
LOGIN    ttyS0        2020-05-02 11:24              1124 id=tyS0

So we see that information related to system login processes was displayed in the output. 

Where -l is to print system login processes.

4. Get the hostname and user associated with stdin

This is done using the -m option. Example below:

-m  is to show only hostname and user associated with stdin

# who -m
root     pts/0        2020-05-06 09:55 (:0.0)

So we see that the relevant information was produced in the output.

5. Get the current run level

This is done using the -r option. Example below: 

-r to print current runlevel

# who -r
run-level 3  2020-05-02 11:24

So we see that the information related to current run level (which is 3) was produced in the output.

6. Get the number of users logged-in and their usernames

This is done using the -q option. Example below: 

$ who -q
root tecnmint unix101
# users=3

So we see that information related to number of logged-in users and their user names was produced in the output.

7. Get all the information

This is done using the -a option. Consider the following example: 

# who -a
system boot  2020-05-02 11:24
run-level 3  2020-05-02 11:24
LOGIN      tty1         2020-05-02 11:24              1129 id=tty1
LOGIN      ttyS0        2020-05-02 11:24              1124 id=tyS0
root     + pts/0        2020-05-06 09:55   .         19018 (:0)
technicalmint      + pts/2   2020-05-06 09:56 00:13       19056 (:0.0)
unix101 + pts/3        2020-05-06 09:56 00:13       19086 (:0.0)

So we see that all the information that ‘who’ can print is produced in output.

 

2. last command:

To find out when a particular user last logged in to the Linux or Unix server.

Syntax

# last
# last [userNameHere]
# last [tty]
# last [options] [userNameHere]

If no options are provided, last command displays a list of all the users logged in (and out). You can filter out the results by supplying username or terminal to show only those entries matching the username/tty.

Examples of ‘last’ command

1. To find out who has recently logged in and out on your server, type:

$ last
technicalmint pts/3        10.1.6.120  Wed May  6 09:56   still logged in   
unix101      pts/2        10.1.6.120  Wed May  6 09:56   still logged in   
root     pts/0        10.1.6.120  Wed May  6 09:55   still logged in   
root     pts/0        10.1.6.120  Wed May  6 08:42 - 09:55  (01:13)    
root     pts/0        10.1.6.120   Sun May  3 13:56 - 17:26  (03:30)      
root     pts/0        10.1.6.120    Sat May  2 11:30 - 01:54  (14:23)    
reboot   system boot  3.10.0-1127.el7. Sat May  2 11:24 - 10:14 (3+22:49)   
root     pts/0        10.1.6.120   Sat May  2 11:08 - down   (00:15)    
reboot   system boot  3.10.0-1127.el7. Sat May  2 11:08 - 11:24  (00:16)    
root     pts/0        10.1.6.120    Sat May  2 10:48 - down   (00:19)    
reboot   system boot  3.10.0-957.27.2. Sat May  2 10:47 - 11:08  (00:20) 
wtmp begins Sat May  2 10:47:10 2020   

2. List all users last logged in/out time

last command searches back through the file /var/log/wtmp file and the output may go back to several months. Just use the less command or more command as follows to display output one screen at a time:

$ last | more
$ last | less

3. List a particular user last logged in

To find out when a user was last logged in, run below command:

$ last technicalmint
technicalmint     pts/0        10.1.6.120  Wed May  6 09:55   still logged in   
root     pts/0        10.1.6.120  Wed May  6 08:42 - 09:55  (01:13)
root     pts/0        10.1.6.120  Tue May  5 20:32 - 01:11  (04:38)

4. Hide hostnames (Linux only)

To hide the display of the hostname field pass -R option:

# last -R
technicalmint pts/3        Wed May  6 09:56   still logged in   
mgk      pts/2        Wed May  6 09:56   still logged in   
root     pts/0        Wed May  6 09:55   still logged in   
root     pts/0        Wed May  6 08:42 - 09:55  (01:13)    
root     pts/0        Tue May  5 20:32 - 01:11  (04:38)       
root     pts/0        Sat May  2 11:30 - 01:54  (14:23)    
reboot   system boot  Sat May  2 11:24 - 10:20 (3+22:55)   
root     pts/0        Sat May  2 11:08 - down   (00:15)    
reboot   system boot  Sat May  2 11:08 - 11:24  (00:16)    
root     pts/0        Sat May  2 10:48 - down   (00:19)    
reboot   system boot  Sat May  2 10:47 - 11:08  (00:20)    
wtmp begins Sat May  2 10:47:10 2020

Check for a specific user:

#  last -R root
root     pts/0        Wed May  6 09:55   still logged in   
root     pts/0        Wed May  6 08:42 - 09:55  (01:13)    
root     pts/0        Tue May  5 20:32 - 01:11  (04:38)    
root     pts/0        Mon May  4 11:19 - 01:42  (14:22)     
root     pts/0        Sat May  2 11:08 - down   (00:15)    
root     pts/0        Sat May  2 10:48 - down   (00:19)    

5. Display complete login & logout times

By default, an year is displayed by last command. You can force last command to display full login and logout times and dates by passing -F option:

Example:

# last -F
technicalmint pts/3        10.1.6.120  Wed May  6 09:56:48 2020   still logged in                      
unix101      pts/2        10.1.6.120  Wed May  6 09:56:31 2020   still logged in                      
root     pts/0        10.1.6.120  Wed May  6 09:55:45 2020   still logged in                      
root     pts/0        10.1.6.120 Wed May  6 08:42:05 2020 - Wed May  6 09:55:27 2020  (01:13)    
root     pts/0       10.1.6.120  Tue May  5 20:32:12 2020 - Wed May  6 01:11:05 2020  (04:38)    
root     pts/0        10.1.6.120   Mon May  4 11:19:37 2020 - Tue May  5 01:42:24 2020  (14:22)    
reboot   system boot  3.10.0-957.27.2. Sat May  2 10:47:10 2020 - Sat May  2 11:08:09 2020  (00:20)

6. Display last reboot time

The user’s reboot logs are created each time the system is rebooted. Thus, following command will show the logs for all the reboots since the log file was created:

# last reboot
reboot   system boot  3.10.0-1127.el7. Sat May  2 11:24 - 10:31 (3+23:07)   
reboot   system boot  3.10.0-1127.el7. Sat May  2 11:08 - 11:24  (00:16)    
reboot   system boot  3.10.0-957.27.2. Sat May  2 10:47 - 11:08  (00:20)    

7. Display last shutdown time

Find out the system shutdown entries and run level changes:

# last -x
# last -x shutdown
shutdown system down  3.10.0-1127.el7. Sat May  2 11:24 - 11:24  (00:00)    
shutdown system down  3.10.0-957.27.2. Sat May  2 11:08 - 11:08  (00:00) 

That’s it, Let us know your opinion on this article using the comment section. Thank you.

Leave a Reply

Your email address will not be published. Required fields are marked *