Peek into the /var/log/wtmp ledger and reconstruct who logged in and when. 31.03.2026 | reading time: 3 min Who connected to the server this morning and when did the system reboot? The `last` command reads the binary ledger at /var/log/wtmp and prints historical login, logout and reboot records so an administrator can reconstruct user and system activity. See it in action Run a short query and inspect the lines yourself; for example use `last -n 7` to list the seven most recent entries and `last reboot` to focus on reboots; a sample session looks like this: ```$ last -n 7 alice pts/0 192.0.2.10 Fri Mar 12 10:23 still logged in bob tty1 Thu Mar 11 08:15 - 09:00 (00:45) reboot system boot 5.11.0-27-generic Fri Mar 11 01:02 - 12:00 (10:58) shutdown system down 5.11.0-27-generic Thu Mar 10 23:58 - 01:02 (01:04) charlie pts/2 198.51.100.5 Thu Mar 10 20:10 - 20:45 (00:35) wtmp begins Thu Mar 10 00:00:00 2026 ``` Options that matter Filter, expand, or read rotated logs; use `-n` or `--limit` to restrict output, `-f` to read an alternate wtmp file, `-a` or `-i` to show hostnames or IPs in the last column, and `-x` to include system shutdown and runlevel changes; combine options to answer concrete questions fast. When `last` is not enough Use `last` for an immediate audit of interactive sessions and boots, but complement it with log sources: check `journalctl` for service start events, `/var/log/auth.log` or `secure` for authentication detail, and `who` or `w` for live presence; rotated files often live as /var/log/wtmp.1 so remember `last -f`. Quick forensic tips Prefer reading the wtmp copy from a consistent backup to avoid races, parse `last` output in scripts with `-F` for full timestamps, and watch for entries marked "still logged in" when correlating with other logs; small habits save hours during incident work. Parting view `last` is a compact, reliable historian for logins and reboots and it rewards practice: run targeted queries, combine outputs with other logs, and build short scripts to automate routine checks; keep exploring Linux logging to deepen operational skills and consider formal certification such as CompTIA Linux+ or LPIC-1 with intensive exam preparation at bitsandbytes.academy for structured advancement. Join Bits & Bytes Academy First class LINUX exam preparation. utilities security boot-process troubleshooting
