Linux 的登录日志记录于 /var/log/wtmp 文件中，该日志文件永久记录每个用户登录、注销及系统的启动、停机的事件。因此随着系统正常运行时间的增加，该文件的大小也会越来越大，增加的速度取决于系统用户登录的次数。该日志文件可以用来查看用户的登录记录。
last 命令就通过访问这个文件获得这些信息，并以反序从后向前显示用户的登录记录， last 也能根据用户、终端tty或时间显示相应的记录。
提示
/var/log/wtmp 文件可以被 root 用户删除。
$ last -f /var/log/wtmp ubuntu pts/0 125.123.140.215 Thu Jul 28 11:06 still logged in ubuntu pts/3 125.123.142.20 Thu Jul 21 16:27 - 18:22 (01:55) ubuntu pts/2 125.123.142.20 Thu Jul 21 16:23 - 18:22 (01:58) ubuntu pts/0 125.123.142.20 Thu Jul 21 16:20 - 18:22 (02:01) ubuntu pts/0 125.123.136.219 Wed Jun 1 14:28 - 18:54 (04:25) ubuntu pts/0 125.123.141.115 Wed May 25 14:11 - 14:16 (00:04) ubuntu pts/0 125.123.139.19 Mon Nov 22 10:47 - 10:49 (00:01) ubuntu pts/0 125.123.138.20 Wed Nov 10 18:26 - 18:27 (00:00) ubuntu pts/0 125.123.138.20 Wed Nov 10 17:37 - 17:42 (00:04) ubuntu pts/0 125.123.143.0 Thu Nov 4 15:49 - 15:50 (00:01) ubuntu pts/0 125.123.143.0 Thu Nov 4 15:44 - 15:45 (00:00) ubuntu pts/2 125.123.143.120 Thu Oct 28 09:31 - 09:34 (00:03) ubuntu pts/0 125.123.143.120 Thu Oct 28 09:28 - 09:34 (00:05) ubuntu pts/0 125.123.141.116 Fri Oct 22 08:40 - 08:42 (00:01) ubuntu pts/0 125.123.137.198 Fri Sep 17 10:54 - 11:02 (00:07) ubuntu pts/0 125.123.136.198 Thu Sep 2 08:50 - 08:51 (00:01) ubuntu pts/0 125.123.140.189 Wed Sep 1 09:10 - 09:10 (00:00) ubuntu pts/0 125.123.140.189 Tue Aug 31 16:34 - 16:38 (00:03) ubuntu pts/0 115.239.26.211 Thu Aug 26 17:09 - 17:18 (00:08) ubuntu pts/2 115.239.27.164 Fri Jul 9 11:25 - 14:02 (02:37) ubuntu pts/0 115.239.27.164 Fri Jul 9 11:20 - 14:02 (02:42) ubuntu pts/0 115.239.26.197 Fri Jun 4 09:07 - 09:09 (00:02) ubuntu pts/0 115.239.26.197 Fri Jun 4 08:39 - 08:40 (00:01) ubuntu pts/0 115.239.26.197 Fri Jun 4 08:31 - 08:36 (00:05) ubuntu pts/0 183.141.77.105 Tue Jun 1 08:54 - 08:57 (00:03) ubuntu pts/0 183.141.77.105 Mon May 31 16:39 - 16:41 (00:02) ubuntu pts/0 183.141.77.105 Mon May 31 14:06 - 14:08 (00:01) ubuntu pts/0 183.141.77.105 Mon May 31 10:55 - 11:21 (00:25) ubuntu pts/2 111.1.147.11 Wed May 26 20:08 - 22:34 (02:26) ubuntu pts/0 111.1.147.11 Wed May 26 19:28 - 22:34 (03:05) ubuntu pts/2 183.141.79.201 Wed May 26 18:29 - 18:51 (00:22) ubuntu pts/2 183.141.79.201 Wed May 26 18:16 - 18:28 (00:12) ubuntu pts/0 183.141.79.201 Wed May 26 17:02 - 18:29 (01:27) ubuntu pts/0 115.239.26.205 Thu May 20 16:57 - 16:58 (00:00) ubuntu pts/2 :pts/0:S.0 Thu May 20 15:58 - 15:58 (00:00) ubuntu pts/0 115.239.26.205 Thu May 20 15:58 - 16:08 (00:09) ubuntu pts/0 115.239.26.205 Thu May 20 15:25 - 15:30 (00:04) ubuntu pts/0 183.141.78.242 Wed Apr 14 18:26 - 19:40 (01:13) ubuntu pts/0 183.141.34.219 Mon Apr 12 14:03 - 17:11 (03:08) ubuntu pts/0 125.123.143.170 Tue Apr 6 15:26 - 16:04 (00:37) ubuntu pts/0 183.141.32.248 Thu Mar 18 11:18 - 14:00 (02:42) ubuntu pts/0 223.104.175.140 Thu Feb 18 19:11 - 21:32 (02:20) ubuntu pts/0 223.104.176.17 Thu Feb 18 14:11 - 16:26 (02:15) ubuntu pts/0 125.123.143.251 Mon Feb 8 09:27 - 11:40 (02:13) ubuntu pts/0 121.37.197.39 Sun Feb 7 18:35 - 18:35 (00:00) ubuntu pts/0 125.123.143.41 Sun Feb 7 15:07 - 15:30 (00:22) ubuntu pts/0 125.123.143.41 Sun Feb 7 14:01 - 14:49 (00:48) ubuntu pts/2 125.123.143.41 Sat Feb 6 10:28 - 10:42 (00:14) ubuntu pts/0 125.123.143.41 Sat Feb 6 10:27 - 10:49 (00:21) ubuntu pts/0 125.123.139.108 Wed Feb 3 09:40 - 09:48 (00:08) ubuntu pts/0 125.123.140.237 Sat Jan 30 14:44 - 14:47 (00:02) ubuntu pts/0 125.123.140.237 Fri Jan 29 16:10 - 17:30 (01:19) ubuntu pts/0 125.123.140.237 Fri Jan 29 14:28 - 15:34 (01:05) ubuntu pts/2 125.123.136.254 Sat Jan 23 14:00 - 14:39 (00:39) ubuntu pts/0 125.123.136.254 Sat Jan 23 14:00 - 14:39 (00:38) ubuntu pts/0 183.141.34.118 Fri Jan 22 08:52 - 09:12 (00:19) ubuntu pts/0 183.141.34.118 Thu Jan 21 18:40 - 18:46 (00:06) ubuntu pts/0 115.239.26.127 Thu Jan 21 11:55 - 11:57 (00:01) ubuntu pts/0 125.123.140.249 Sat Jan 16 18:21 - 18:46 (00:25) ubuntu pts/0 125.123.140.249 Sat Jan 16 13:09 - 13:12 (00:02) ubuntu pts/0 125.123.140.249 Sat Jan 16 12:01 - 12:02 (00:01) ubuntu pts/0 114.84.79.10 Fri Jan 15 11:30 - 13:33 (02:02) ubuntu pts/0 125.123.140.249 Thu Jan 14 18:52 - 19:11 (00:19) ubuntu pts/0 125.123.140.249 Wed Jan 13 14:58 - 16:20 (01:21) ubuntu pts/0 125.123.140.9 Mon Jan 11 14:58 - 16:03 (01:04) ubuntu pts/0 115.239.24.11 Fri Jan 8 18:28 - 18:30 (00:01) ubuntu pts/0 115.239.24.11 Wed Jan 6 09:24 - 11:39 (02:15) ubuntu pts/0 115.239.24.11 Tue Jan 5 15:28 - 17:41 (02:13) ubuntu pts/0 115.239.24.11 Tue Jan 5 14:21 - 14:35 (00:14) ubuntu pts/0 125.123.140.46 Mon Jan 4 16:47 - 18:56 (02:08) ubuntu pts/0 115.239.24.105 Thu Dec 31 17:35 - 18:16 (00:41) ubuntu pts/0 115.239.24.105 Thu Dec 31 10:18 - 13:24 (03:05) ubuntu pts/0 115.239.24.105 Mon Dec 28 19:12 - 19:17 (00:04) ubuntu pts/2 183.141.78.12 Thu Dec 24 16:07 - 16:48 (00:41) ubuntu pts/0 183.141.78.12 Thu Dec 24 15:55 - 17:20 (01:25) ubuntu pts/0 183.141.78.12 Thu Dec 24 08:42 - 09:56 (01:14) ubuntu pts/0 125.123.142.167 Wed Dec 23 16:43 - 17:31 (00:47) ubuntu pts/0 125.123.142.167 Tue Dec 22 14:43 - 17:24 (02:40) ubuntu pts/0 125.123.142.167 Mon Dec 21 10:56 - 10:57 (00:00) ubuntu pts/2 124.160.212.20 Sat Dec 19 14:46 - 15:26 (00:40) ubuntu pts/0 111.3.4.150 Sat Dec 19 14:44 - 16:57 (02:13) ubuntu pts/0 111.3.4.150 Sat Dec 19 14:37 - 14:43 (00:06) ubuntu pts/0 223.102.54.85 Sat Dec 19 12:32 - 12:36 (00:03) ubuntu pts/0 111.3.4.150 Sat Dec 19 11:56 - 11:59 (00:02) ubuntu pts/0 223.104.237.67 Sat Dec 19 07:23 - 08:35 (01:12) ubuntu pts/0 223.104.177.36 Fri Dec 18 20:38 - 21:41 (01:03) ubuntu pts/0 223.104.177.58 Fri Dec 18 09:07 - 09:07 (00:00) ubuntu pts/0 223.104.177.58 Thu Dec 17 18:36 - 18:54 (00:18) ubuntu pts/0 223.104.177.58 Thu Dec 17 14:07 - 16:22 (02:15) ubuntu pts/0 115.239.27.88 Fri Dec 4 17:26 - 19:02 (01:35) ubuntu pts/0 125.123.139.151 Thu Dec 3 09:23 - 14:09 (04:45) ubuntu pts/0 125.123.139.151 Wed Dec 2 15:35 - 18:48 (03:13) ubuntu pts/0 125.123.139.151 Wed Dec 2 14:08 - 14:09 (00:01) ubuntu pts/2 125.123.139.151 Wed Dec 2 10:21 - 10:44 (00:22) ubuntu pts/2 125.123.139.151 Wed Dec 2 10:21 - 10:21 (00:00) ubuntu pts/0 125.123.139.151 Wed Dec 2 10:20 - 10:27 (00:06) ubuntu pts/0 125.123.139.151 Tue Dec 1 09:18 - 18:50 (09:31) ubuntu pts/0 125.123.139.151 Mon Nov 30 11:35 - 18:34 (06:59) ubuntu pts/0 218.73.117.133 Sat Nov 28 17:20 - 17:57 (00:36) ubuntu pts/0 218.73.117.133 Fri Nov 27 13:07 - 18:47 (05:40) ubuntu pts/0 218.73.117.133 Thu Nov 26 18:04 - 18:08 (00:04) ubuntu pts/0 218.73.116.47 Fri Nov 20 15:10 - 15:14 (00:04) ubuntu pts/0 218.73.116.47 Thu Nov 19 18:56 - 18:58 (00:02) ubuntu pts/0 218.73.116.47 Thu Nov 19 16:50 - 17:39 (00:48) ubuntu pts/0 125.123.137.117 Wed Nov 18 13:18 - 19:10 (05:52) ubuntu pts/0 125.123.137.117 Wed Nov 18 08:52 - 13:00 (04:08) ubuntu pts/0 125.123.137.2 Tue Nov 3 17:32 - 17:57 (00:25) ubuntu pts/2 218.73.117.114 Fri Oct 30 17:09 - 21:16 (04:06) ubuntu pts/2 218.73.117.114 Fri Oct 30 15:46 - 16:45 (00:59) ubuntu pts/0 218.73.117.114 Fri Oct 30 15:07 - 17:47 (02:40) ubuntu pts/0 218.73.117.114 Fri Oct 30 14:40 - 15:05 (00:25) ubuntu pts/0 218.73.117.114 Fri Oct 30 14:35 - 14:39 (00:04) ubuntu pts/0 218.73.117.114 Fri Oct 30 14:24 - 14:33 (00:08) ubuntu pts/0 218.73.117.114 Fri Oct 30 14:12 - 14:24 (00:12) ubuntu pts/0 218.73.117.114 Fri Oct 30 14:09 - 14:11 (00:02) ubuntu pts/0 218.73.117.114 Fri Oct 30 13:10 - 14:06 (00:55) ubuntu pts/0 218.73.117.114 Fri Oct 30 13:02 - 13:10 (00:08) ubuntu pts/0 218.73.117.114 Fri Oct 30 12:59 - 13:00 (00:01) ubuntu pts/0 218.73.117.114 Fri Oct 30 11:53 - 11:59 (00:06) ubuntu pts/0 218.73.117.114 Fri Oct 30 11:48 - 11:50 (00:01) ubuntu pts/0 218.73.117.114 Fri Oct 30 11:47 - 11:48 (00:00) ubuntu pts/0 218.73.117.114 Fri Oct 30 11:46 - 11:47 (00:00) ubuntu pts/0 218.73.117.114 Fri Oct 30 11:27 - 11:46 (00:19) reboot system boot 5.4.0-52-generic Fri Oct 30 19:26 still running ubuntu pts/0 218.73.117.114 Fri Oct 30 11:21 - 11:26 (00:05) root pts/0 218.73.117.114 Fri Oct 30 11:02 - 11:21 (00:18) root pts/0 116.234.235.17 Tue Oct 27 18:49 - 18:50 (00:00) reboot system boot 5.4.0-47-generic Wed Oct 28 00:46 - 11:26 (2+10:39)
