极客笔记Linux last命令：显示近期用户登录情况。
Linux last命令 功能描述
使用last命令可以显示用户最后登录的信息，该命令是通过读取/var/log/wtmp文件内容，并把该文件内记录的用户最后登录信息，全部显示出来。
Linux last命令 语法
last [选项] [用户] [终端]
命令中各选项的含义如下表所示。
Linux last命令 示例
显示用户root在控制台终端的所有登录信息
[root@rhel ～]# last root console
root pts/0 192.168.0.200 Mon Aug 19 02:10 still logged in
root pts/0 192.168.0.200 Mon Aug 19 02:06-down (00:01)
root tty7 :0 Mon Aug 19 01:08-01:09 (00:00)
root tty1 :0 Mon Aug 19 01:07-01:08 (00:00)
root pts/0 192.168.0.200 Mon Aug 19 00:53-down (00:07)
root tty1 :0 Mon Aug 19 00:53-down (00:08)
root pts/1 192.168.0.200 Mon Aug 19 00:49-down (00:00)
root pts/0 :0.0 Mon Aug 19 00:48-down (00:02)
root tty1 :0 Mon Aug 19 00:47-down (00:02)
wtmp begins Mon Aug 19 00:45:102013
显示近期系统重新引导间的时间
[root@rhel ～]# last reboot
reboot system boot 2.6.32-358.el6.x Mon Aug 19 02:08-04:00 (01:51)
reboot system boot 2.6.32-358.el6.x Mon Aug 19 01:02-02:07 (01:05)
reboot system boot 2.6.32-358.el6.x Mon Aug 19 00:51-01:01 (00:10)
reboot system boot 2.6.32-358.el6.x Mon Aug 19 00:45-00:50 (00:04)
wtmp begins Mon Aug 19 00:45:102013
显示近期用户的登录情况
[root@rhel ～]# last
root pts/0 192.168.0.200 Mon Aug 19 02:10 still logged in
reboot system boot 2.6.32-358.el6.x Mon Aug 19 02:08-04:02 (01:53)
root pts/0 192.168.0.200 Mon Aug 19 02:06-down (00:01)
root tty7 :0 Mon Aug 19 01:08-01:09 (00:00)
root tty1 :0 Mon Aug 19 01:07-01:08 (00:00)
reboot system boot 2.6.32-358.el6.x Mon Aug 19 01:02-02:07 (01:05)
root pts/0 192.168.0.200 Mon Aug 19 00:53-down (00:07)
root tty1 :0 Mon Aug 19 00:53-down (00:08)
reboot system boot 2.6.32-358.el6.x Mon Aug 19 00:51-01:01 (00:10)
root pts/1 192.168.0.200 Mon Aug 19 00:49-down (00:00)
root pts/0 :0.0 Mon Aug 19 00:48-down (00:02)
root tty1 :0 Mon Aug 19 00:47-down (00:02)
reboot system boot 2.6.32-358.el6.x Mon Aug 19 00:45-00:50 (00:04)
wtmp begins Mon Aug 19 00:45:102013
显示用户root所有登录信息的前6行记录
[root@rhel ～]# last -n 6
root pts/0 192.168.0.200 Mon Aug 19 02:10 still logged in
reboot system boot 2.6.32-358.el6.x Mon Aug 19 02:08-04:00 (01:52)
root pts/0 192.168.0.200 Mon Aug 19 02:06-down (00:01)
root tty7 :0 Mon Aug 19 01:08-01:09 (00:00)
root tty1 :0 Mon Aug 19 01:07-01:08 (00:00)
reboot system boot 2.6.32-358.el6.x Mon Aug 19 01:02-02:07 (01:05)
wtmp begins Mon Aug 19 00:45:102013
显示系统shutdown记录和运行级别的变化
[root@rhel ～]# last -x
root pts/0 192.168.0.200 Mon Aug 19 02:10 still logged in
runlevel(to lvl 5) 2.6.32-358.el6.x Mon Aug 19 02:08-04:06 (01:57)
reboot system boot 2.6.32-358.el6.x Mon Aug 19 02:08-04:06 (01:57)
shutdown system down 2.6.32-358.el6.x Mon Aug 19 02:07-02:08 (00:00)
runlevel(to lvl 6) 2.6.32-358.el6.x Mon Aug 19 02:07-02:07 (00:00)
root pts/0 192.168.0.200 Mon Aug 19 02:06-down (00:01)
root tty7 :0 Mon Aug 19 01:08-01:09 (00:00)
root tty1 :0 Mon Aug 19 01:07-01:08 (00:00)
runlevel(to lvl 5) 2.6.32-358.el6.x Mon Aug 19 01:02-02:07 (01:05)
reboot system boot 2.6.32-358.el6.x Mon Aug 19 01:02-02:07 (01:05)
shutdown system down 2.6.32-358.el6.x Mon Aug 19 01:01-01:02 (00:00)
runlevel(to lvl 6) 2.6.32-358.el6.x Mon Aug 19 01:01-01:01 (00:00)
root pts/0 192.168.0.200 Mon Aug 19 00:53-down (00:07)
root tty1 :0 Mon Aug 19 00:53-down (00:08)
runlevel(to lvl 5) 2.6.32-358.el6.x Mon Aug 19 00:51-01:01 (00:10)
reboot system boot 2.6.32-358.el6.x Mon Aug 19 00:51-01:01 (00:10)
shutdown system down 2.6.32-358.el6.x Mon Aug 19 00:50-00:51 (00:00)
runlevel(to lvl 6) 2.6.32-358.el6.x Mon Aug 19 00:50-00:50 (00:00)
root pts/1 192.168.0.200 Mon Aug 19 00:49-down (00:00)
root pts/0 :0.0 Mon Aug 19 00:48-down (00:02)
root tty1 :0 Mon Aug 19 00:47-down (00:02)
runlevel(to lvl 5) 2.6.32-358.el6.x Mon Aug 19 00:45-00:50 (00:04)
reboot system boot 2.6.32-358.el6.x Mon Aug 19 00:45-00:50 (00:04)
wtmp begins Mon Aug 19 00:45:102013