last 功能说明: 列出目前与过去登入系统的用户相关信息
语法: last [-adRx] [-f] [-n] [帐号名称] [终端机编号..]
补充说明: 单独执行last指令,它会读取位于/var/log目录下,名称为wtmp的文件,并把该给文件的内容记录的登入系统的用户名单全部显示出来
参数: -a :把从何处登入系统的主机名称或IP地址,显示在最后一行 -d :将IP地址转换成主机名称 -f :指定记录文件 -n :设置列出名单的显示列数 -R :不显示登入系统的主机名称或IP地址 -x :显示系统关机,重新开机,以及执行等级的改变等信息
命令实践: [iyunv@yubing ~]# last yubing pts/0 10.0.0.112 Mon May 6 13:06 still logged in yubing pts/0 10.0.0.112 Mon May 6 13:05 - 13:06 (00:00) yubing pts/0 10.0.0.112 Mon May 6 18:42 - 13:04 (-5:-37) root tty1 Mon May 6 18:41 still logged in reboot system boot 2.6.18-194.el5 Mon May 6 18:41 (-1:-43) yubing pts/0 10.0.0.112 Mon May 6 01:45 - 20:05 (-5:-39) root tty1 Mon May 6 01:45 - crash (16:56) reboot system boot 2.6.18-194.el5 Mon May 6 01:45 (15:12) yubing pts/0 10.0.0.112 Sun May 5 12:54 - crash (12:51) yubing pts/0 10.0.0.112 Sun May 5 12:43 - 12:53 (00:10) yubing pts/0 10.0.0.112 Sun May 5 16:39 - 12:43 (-3:-56) root tty1 Sun May 5 16:39 - crash (09:06) reboot system boot 2.6.18-194.el5 Sun May 5 16:37 (1+00:20) yubing pts/0 10.0.0.131 Sun Apr 21 19:30 - 20:00 (00:29) yubing pts/0 10.0.0.131 Sun Apr 21 16:25 - 19:30 (03:05) yubing pts/0 10.0.0.131 Sun Apr 21 14:09 - 16:24 (02:15) yubing pts/0 10.0.0.131 Sun Apr 21 08:55 - 12:54 (03:59) root tty1 Sun Apr 21 16:54 - crash (13+23:42) reboot system boot 2.6.18-194.el5 Sun Apr 21 16:52 (15+00:04) yubing pts/0 10.0.0.131 Fri Apr 19 23:06 - 17:40 (-5:-25) root tty1 Fri Apr 19 23:05 -crash (1+17:46) reboot system boot 2.6.18-194.el5 Fri Apr 19 23:05 (16+17:52) reboot system boot 2.6.18-194.el5 Fri Apr 19 03:48 (17+13:08) yubing pts/0 10.0.0.131 Fri Apr 19 00:14 - 18:59 (-5:-15) root tty1 Fri Apr 19 00:14 -crash (03:34) reboot system boot 2.6.18-194.el5 Fri Apr 19 00:14 (17+16:43) root tty1 Thu Apr 18 14:35 -crash (09:38) reboot system boot 2.6.18-194.el5 Thu Apr 18 22:34 (17+18:23) yubing pts/0 10.0.0.131 Thu Apr 18 13:02 - 14:18 (01:16) root tty1 Thu Apr 18 13:01 -crash (09:33) reboot system boot 2.6.18-194.el5 Thu Apr 18 20:59 (17+19:57) yubing pts/0 10.0.0.131 Thu Apr 18 19:31 - 12:16 (-7:-14) root tty1 Thu Apr 18 19:30 -crash (01:29) reboot system boot 2.6.18-194.el5 Thu Apr 18 19:30 (17+21:27) root tty1 Thu Apr 18 03:54 -crash (15:35) reboot system boot 2.6.18-194.el5 Thu Apr 18 03:54 (18+13:03) yubing pts/0 10.0.0.131 Thu Apr 18 01:12 - 18:04 (-7:-8) root tty1 Thu Apr 18 01:12 - crash (02:41) reboot system boot 2.6.18-194.el5 Thu Apr 18 01:12 (18+15:45) yubing pts/0 10.0.0.131 Wed Apr 17 14:18 - 16:31 (02:13) yubing pts/0 10.0.0.131 Wed Apr 17 20:58 - 14:18 (-6:-40) root tty1 Wed Apr 17 20:57 -crash (04:14) reboot system boot 2.6.18-194.el5 Wed Apr 17 20:55 (18+20:02) yubing pts/0 10.0.0.131 Wed Apr 17 18:49 - 20:11 (01:22) root tty1 Wed Apr 17 18:49 -crash (02:06) reboot system boot 2.6.18-194.el5 Wed Apr 17 18:48 (18+22:08) reboot system boot 2.6.18-194.el5 Tue Apr 16 21:53 (19+19:04) yubing pts/0 10.0.0.131 Tue Apr 16 00:36 - 01:55 (01:19) root tty1 Tue Apr 16 00:35 -crash (21:17) reboot system boot 2.6.18-194.el5 Tue Apr 16 00:33 (20+16:23) yubing pts/0 10.0.0.131 Mon Apr 15 19:05 - crash (05:28) root tty1 Mon Apr 15 19:05 -crash (05:28) reboot system boot 2.6.18-194.el5 Mon Apr 15 19:05 (20+21:52) yubing pts/1 10.0.0.131 Mon Apr 15 03:43 - 03:50 (00:07) yubing pts/1 10.0.0.131 Mon Apr 15 03:34 - 03:43 (00:08) root pts/1 10.0.0.131 Mon Apr 15 02:20 - 03:33 (01:13) root pts/1 10.0.0.131 Mon Apr 15 02:08 - 02:08 (00:00) root pts/1 10.0.0.131 Mon Apr 15 02:00 - 02:07 (00:07) root pts/0 10.0.0.131 Mon Apr 15 01:56 - crash (17:08) root pts/0 10.0.0.131 Mon Apr 15 01:49 - 01:56 (00:07) root pts/0 10.0.0.131 Mon Apr 15 01:44 - 01:49 (00:04) root tty1 Mon Apr 15 01:38 -crash (17:26) reboot system boot 2.6.18-194.el5 Mon Apr 15 01:36 (21+15:20) reboot system boot 2.6.18-194.el5 Mon Apr 15 01:35 (21+15:22) root tty1 Sat Apr 13 22:57 -crash (1+02:37) reboot system boot 2.6.18-194.el5 Sat Apr 13 22:57 (22+18:00) root tty1 Sat Apr 13 18:57 -crash (03:59) reboot system boot 2.6.18-194.el5 Sat Apr 13 18:50 (22+22:07)
wtmp begins Sat Apr 13 18:50:022013 [iyunv@yubing ~]#
|