How to use who/last Command in Linux/Centos
Following are the basic user monitor commands:
- who
- last
1. who command:
As a Linux user, sometimes it is required to know some basic information like:
- Time of last system boot
- List of users logged-in
- Current run level etc
Though this type of information can be obtained from various files in the Linux system but there is a command line utility ‘who’ that does exactly the same for you. In this article, we will discuss the capabilities and features provided by the command ‘who’.
Syntax:
# who [OPTION]... [ FILE | ARG1 ARG2 ]Examples of ‘who’ command
1. Get the information on currently logged in users
This is done by simply running the ‘who’ command (without any options). Consider the following example which shows the current logged-in users.
$ who
root pts/0 2020-05-06 09:55 05:33 (:0)
technicalmint pts/0 2020-05-06 06:47 (:0.0)unix101 pts/2 2020-05-06 07:58 (:0.0)
2. Get the time of last system boot
The is done using the -b option. Example below:
# who -b
system boot 2020-05-02 11:24We can see that the above output gives the exact date and time of last system boot.
3. Get information on system login processes
This is done using the -l option. Example below:
# who -l
LOGIN tty1 2020-05-02 11:24 1129 id=tty1
LOGIN ttyS0 2020-05-02 11:24 1124 id=tyS0So we see that information related to system login processes was displayed in the output.
Where -l is to print system login processes.
4. Get the hostname and user associated with stdin
This is done using the -m option. Example below:
-m is to show only hostname and user associated with stdin
# who -m
root pts/0 2020-05-06 09:55 (:0.0)So we see that the relevant information was produced in the output.
5. Get the current run level
This is done using the -r option. Example below:
-r to print current runlevel
# who -r
run-level 3 2020-05-02 11:24So we see that the information related to current run level (which is 3) was produced in the output.
6. Get the number of users logged-in and their usernames
This is done using the -q option. Example below:
$ who -q
root tecnmint unix101
# users=3So we see that information related to number of logged-in users and their user names was produced in the output.
7. Get all the information
This is done using the -a option. Consider the following example:
# who -a
system boot 2020-05-02 11:24
run-level 3 2020-05-02 11:24
LOGIN tty1 2020-05-02 11:24 1129 id=tty1
LOGIN ttyS0 2020-05-02 11:24 1124 id=tyS0
root + pts/0 2020-05-06 09:55 . 19018 (:0)
technicalmint + pts/2 2020-05-06 09:56 00:13 19056 (:0.0)
unix101 + pts/3 2020-05-06 09:56 00:13 19086 (:0.0)So we see that all the information that ‘who’ can print is produced in output.
2. last command:
To find out when a particular user last logged in to the Linux or Unix server.
Syntax
# last
# last [userNameHere]
# last [tty]
# last [options] [userNameHere]If no options are provided, last command displays a list of all the users logged in (and out). You can filter out the results by supplying username or terminal to show only those entries matching the username/tty.
Examples of ‘last’ command
1. To find out who has recently logged in and out on your server, type:
$ last
technicalmint pts/3 10.1.6.120 Wed May 6 09:56 still logged in
unix101 pts/2 10.1.6.120 Wed May 6 09:56 still logged in
root pts/0 10.1.6.120 Wed May 6 09:55 still logged in
root pts/0 10.1.6.120 Wed May 6 08:42 - 09:55 (01:13)
root pts/0 10.1.6.120 Sun May 3 13:56 - 17:26 (03:30)
root pts/0 10.1.6.120 Sat May 2 11:30 - 01:54 (14:23)
reboot system boot 3.10.0-1127.el7. Sat May 2 11:24 - 10:14 (3+22:49)
root pts/0 10.1.6.120 Sat May 2 11:08 - down (00:15)
reboot system boot 3.10.0-1127.el7. Sat May 2 11:08 - 11:24 (00:16)
root pts/0 10.1.6.120 Sat May 2 10:48 - down (00:19)
reboot system boot 3.10.0-957.27.2. Sat May 2 10:47 - 11:08 (00:20)
wtmp begins Sat May 2 10:47:10 2020
2. List all users last logged in/out time
last command searches back through the file /var/log/wtmp file and the output may go back to several months. Just use the less command or more command as follows to display output one screen at a time:
$ last | more
$ last | less3. List a particular user last logged in
To find out when a user was last logged in, run below command:
$ last technicalmint
technicalmint pts/0 10.1.6.120 Wed May 6 09:55 still logged in
root pts/0 10.1.6.120 Wed May 6 08:42 - 09:55 (01:13)
root pts/0 10.1.6.120 Tue May 5 20:32 - 01:11 (04:38)4. Hide hostnames (Linux only)
To hide the display of the hostname field pass -R option:
# last -R
technicalmint pts/3 Wed May 6 09:56 still logged in
mgk pts/2 Wed May 6 09:56 still logged in
root pts/0 Wed May 6 09:55 still logged in
root pts/0 Wed May 6 08:42 - 09:55 (01:13)
root pts/0 Tue May 5 20:32 - 01:11 (04:38)
root pts/0 Sat May 2 11:30 - 01:54 (14:23)
reboot system boot Sat May 2 11:24 - 10:20 (3+22:55)
root pts/0 Sat May 2 11:08 - down (00:15)
reboot system boot Sat May 2 11:08 - 11:24 (00:16)
root pts/0 Sat May 2 10:48 - down (00:19)
reboot system boot Sat May 2 10:47 - 11:08 (00:20)
wtmp begins Sat May 2 10:47:10 2020
Check for a specific user:
# last -R root
root pts/0 Wed May 6 09:55 still logged in
root pts/0 Wed May 6 08:42 - 09:55 (01:13)
root pts/0 Tue May 5 20:32 - 01:11 (04:38)
root pts/0 Mon May 4 11:19 - 01:42 (14:22)
root pts/0 Sat May 2 11:08 - down (00:15)
root pts/0 Sat May 2 10:48 - down (00:19) 5. Display complete login & logout times
By default, an year is displayed by last command. You can force last command to display full login and logout times and dates by passing -F option:
Example:
# last -F
technicalmint pts/3 10.1.6.120 Wed May 6 09:56:48 2020 still logged in
unix101 pts/2 10.1.6.120 Wed May 6 09:56:31 2020 still logged in
root pts/0 10.1.6.120 Wed May 6 09:55:45 2020 still logged in
root pts/0 10.1.6.120 Wed May 6 08:42:05 2020 - Wed May 6 09:55:27 2020 (01:13)
root pts/0 10.1.6.120 Tue May 5 20:32:12 2020 - Wed May 6 01:11:05 2020 (04:38)
root pts/0 10.1.6.120 Mon May 4 11:19:37 2020 - Tue May 5 01:42:24 2020 (14:22)
reboot system boot 3.10.0-957.27.2. Sat May 2 10:47:10 2020 - Sat May 2 11:08:09 2020 (00:20)
6. Display last reboot time
The user’s reboot logs are created each time the system is rebooted. Thus, following command will show the logs for all the reboots since the log file was created:
# last reboot
reboot system boot 3.10.0-1127.el7. Sat May 2 11:24 - 10:31 (3+23:07)
reboot system boot 3.10.0-1127.el7. Sat May 2 11:08 - 11:24 (00:16)
reboot system boot 3.10.0-957.27.2. Sat May 2 10:47 - 11:08 (00:20) 7. Display last shutdown time
Find out the system shutdown entries and run level changes:
# last -x
# last -x shutdown
shutdown system down 3.10.0-1127.el7. Sat May 2 11:24 - 11:24 (00:00)
shutdown system down 3.10.0-957.27.2. Sat May 2 11:08 - 11:08 (00:00)
That’s it, Let us know your opinion on this article using the comment section. Thank you.
