The “last” command is a useful tool in Ubuntu for viewing information about system logins and user activity. It displays a list of the most recent login sessions, along with information such as the user, the time of login, the source IP address, and the duration of the session.
To use the “last” command in Ubuntu, open a terminal window and type “last” followed by the Enter key. By default, the command will display a list of the most recent login sessions, with the most recent session at the top. You can use the arrow keys to scroll through the list, or you can use the “q” key to exit the command.
You can also use various options to customize the output of the “last” command. For example, you can use the “-n” option followed by a number to display a specified number of login sessions. You can also use the “-f” option followed by a filename to display login sessions from a specific file instead of the default “/var/log/wtmp” file.
Here are some examples of how to use the “last” command with different options:
To display the last 10 login sessions, use the command “last -n 10”
To display login sessions from a specific file, use the command “last -f /var/log/wtmp.1”
To display login sessions for a specific user, use the command “last username”
The “last” command can be useful for monitoring user activity on a system and for troubleshooting login issues. It can also be used to identify potential security issues, such as unauthorized login attempts or unusual activity from a particular user or IP address.
Overall, the “last” command is a simple but powerful tool for viewing system login information in Ubuntu, and it can be a valuable addition to your system administration toolkit.