The last command without any options can be used to view the users that have logged into the system. The who and w commands are somewhat similar to the last command. 

The left most column display the name of the user or also system boot message, such as reboot. The second column shows the virtual console being used, such as /dev/pts/0 or /dev/tty1. The third column lists the hostname or IP address of the computer the connection was made from. The fourth column displays when the connection was started and then the connection ended.

[root@server1 ~]# last
john.doe  /dev/pts/0   client1.example.com  Thu Jan 12 12:04  still logged in
root      /dev/tty1    server1.example.com  Wed Jan 11 12:54 - 13:13  (00:19)
reboot    system boot  3-10-0-327.e17.x     Wed Jan 11 12:52 - 13:10  (00:01)
. . .

View certain user

The last command followed by a username can be used to display only a certain user. In this example, only john.doe is displayed.

[root@server1 ~]# last john.doe
john.doe  pts/0   server1.example.com   Thu Jan 12 12:04  still logged in
john.doe  pts/0   server1.example.com   Wed Jan 11 12:52 - 13:02  (00:10)
. . .

View only reboot, shutdown, and runlevel records

The -x option can be used to list only reboot, shutdown, and runlevel records.

[root@server1 ~]# last -x
runlevel  (to lvl 3)   3-10-0-327.el7.x  Wed Jan 11 12:52 - 13:10 (3+21:01)
reboot    system boot  3-10-0-327.el7.x  Wed Jan 11 12:52 - 13:10 (3+21:01)
shutdown  system down  3-10-0-327.el7.x  Wed Jan 11 12:52 - 12:52   (00:00)
. . .

Limit output

The last command can produce quite a bit of output. The -n option can be used to limit the output to a certain number of lines. In this example, the last 5 records are displayed.

[root@server1 ~]# last -n 5
john.doe  pts/0    server1.example.com  Thu Jan 12 12:04  still logged in
root      pts/3    server1.example.com  Wed Jan 11 12:54 - 13:13  (00:19)
john.doe  pts/3    server1.example.com  Wed Jan 11 11:54 - 11:59  (00:50)
jane.doe  pts/3    server1.example.com  Wed Jan 11 10:27 - 14:28  (05:17)
root      pts/3    server1.example.com  Wed Jan 11 10:13 - 13:17  (09:05)

Display full date and time

The -F option can be used to display the full date and time.

[root@server1 ~]# last -F
john.doe  pts/0        server1.example.com  Thu Jan 12 12:04:01 still logged in
root      pts/3        server1.example.com  Wed Jan 11 12:54:01 - Wed Jan 11 12:59:27 (00:05)
. . .

Display full hostname

Long hostnames can be cutoff. In this example, the last command with no options does not display the full kernel version in the column that contain the reboot record.

[root@server1 ~]# last
john.doe  pts/0        server1.example.com  Thu Jan 12 12:04  still logged in
root      pts/3        server1.example.com  Wed Jan 11 12:54 - 13:13  (00:19)
reboot    system boot  3-10-0-327.e17.x86_  Wed Jan 11 12:52 - 13:10  (00:01)
. . .

The -w option can be used to display the full hostname.

[root@server1 ~]# last -w
john.doe  pts/0        server1.example.com  Thu Jan 12 12:04  still logged in
root      pts/3        server1.example.com  Wed Jan 11 12:54 - 13:13  (00:19)
reboot    system boot  3-10-0-327.e17.x86_64  Wed Jan 11 12:52 - 13:10  (00:01)
. . .

Display IP address instead of hostname

The -i option can be used to display an IP address instead of a hostname. In this example, IP address 192.168.0.17 is displayed instead of hostname server1.example.com.

[root@server1 ~]# last -i
john.doe  pts/0        192.168.0.17       Thu Jan 12 12:04  still logged in
root      pts/3        192.168.0.17       Wed Jan 11 12:54 - 13:13  (00:19)
reboot    system boot  3-10-0-327.e17.x   Wed Jan 11 12:52 - 13:10  (00:01)
. . .

Display hostname column last

The -a option can be used to move the hostname column to the rightmost column.

[root@server1 ~]# last -a
john.doe  pts/0    Thu Jan 12 12:04  still logged in  server1.example.com
root      pts/3    Wed Jan 11 12:54 - 13:13  (00:19)  server1.example.com
. . .

Remove hostname column

The -R option can be used to remove the hostname column from the output.

[root@server1 ~]# last -R
john.doe  pts/0   Thu Jan 12 12:04  still logged in
john.doe  pts/0   Wed Jan 11 12:52 - 13:02  (00:10)
. . .

Display logins up to a certain date and time

The -t option followed by YYYYMMDDHHMMSS can be used to display the records since a certain date and time. In this example, only records prior to Jan 1 2017 are displayed.

[root@server1 ~]# last -t 20170101000000
john.doe  pts/0    server1.example.com  Thu Dec 31 12:04 - 19:58  (01:01)
root      pts/3    server1.example.com  Wed Dec 30 12:54 - 13:13  (00:19)
. . .