The “last” command. Not many people I know use it but there are a quite a few things one could do with it often. Let’s look at users, shutdowns and reboots.

The “last or lastb” command is typically used to show a listing of the last logged in/out users. To view when a particular user last logged in run “last [username]”. See output below.

[[email protected] ~]# last danny
danny    pts/1        ftmtj1s.crib     Wed Oct 24 16:51   still logged in
danny    pts/0        python.crib      Wed Oct 24 16:10   still logged in
danny    pts/0        ftmtj1s.crib     Wed Oct 24 14:44 - crash  (01:07)
danny    pts/0        python.crib      Tue Oct 23 16:59 - 17:22  (00:22)
danny    pts/2        python.crib      Tue Oct 23 16:25 - down   (00:32)
danny    pts/1        python.crib      Tue Oct 23 16:09 - down   (00:47)
danny    pts/1        python.crib      Tue Oct 23 16:09 - 16:09  (00:00)
danny    pts/0        ftmtj1s.crib     Tue Oct 23 13:22 - down   (03:34)
danny    pts/0        ftmtj1s.crib     Mon Oct 22 01:18 - 01:43  (00:25)
danny    pts/0        ftmtj1s.crib     Sun Oct 21 01:34 - 21:06  (19:31)
danny    pts/0        ftmtj1s.crib     Sat Oct 20 13:58 - 14:01  (00:03)
danny    pts/0        ftmtj1s.crib     Fri Oct 19 16:52 - 00:23  (07:31)
danny    pts/0        python.crib      Fri Oct 19 11:49 - 14:15  (02:25)
danny    pts/0        python.crib      Thu Oct 18 15:27 - 15:37  (00:09)
danny    pts/0        python.crib      Thu Oct 18 15:22 - 15:23  (00:01)
danny    pts/1        192.168.0.65     Thu Oct 18 15:13 - 15:18  (00:05)
danny    pts/1        192.168.0.65     Thu Oct 18 14:38 - 15:13  (00:35)

Each time time the “reboot” command is executed the “reboot” user logs in. Running the “last reboot” command would then show the last reboot events. See out put below.

[[email protected] ~]# last reboot
reboot   system boot  2.6.18-8.1.14.el Wed Oct 24 15:51          (01:28)
reboot   system boot  2.6.18-8.1.14.el Tue Oct 23 16:59         (1+00:20)
reboot   system boot  2.6.18-8.1.10.el Thu Oct 18 14:30         (5+02:27)
reboot   system boot  2.6.18-8.1.10.el Wed Oct 17 02:05         (1+11:36)
reboot   system boot  2.6.18-8.1.10.el Tue Oct 16 23:00         (1+14:41)
reboot   system boot  2.6.18-8.1.10.el Tue Oct 16 21:05          (01:52)
reboot   system boot  2.6.18-8.1.10.el Fri Oct 12 22:27         (3+16:41)

If you only need halt and shutdown information. Running “last -x | grep down” will do that. See output below.

[[email protected] ~]# last -x | grep down
shutdown system down  2.6.18-8.1.10.el Tue Oct 23 16:58 - 17:22 (1+00:24)
danny    pts/2        python.crib      Tue Oct 23 16:25 - down   (00:32)
danny    pts/1        python.crib      Tue Oct 23 16:09 - down   (00:47)
danny    pts/0        ftmtj1s.crib     Tue Oct 23 13:22 - down   (03:34)
shutdown system down  2.6.18-8.1.10.el Thu Oct 18 13:42 - 16:57 (5+03:15)
danny    pts/3        ftmtj1s.crib     Thu Oct 18 13:28 - down   (00:12)
danny    pts/2        ftmtj1s.crib     Thu Oct 18 13:11 - down   (00:30)
danny    pts/1        192.168.0.65     Thu Oct 18 00:51 - down   (12:49)
danny    pts/0        192.168.0.65     Wed Oct 17 22:08 - down   (15:32)
shutdown system down  2.6.18-8.1.10.el Tue Oct 16 22:58 - 13:41 (1+14:42)
root     tty1                          Tue Oct 16 21:06 - down   (01:51)
shutdown system down  2.6.18-8.1.10.el Tue Oct 16 15:09 - 22:58  (07:48)
danny    pts/0        192.168.0.65     Tue Oct 16 15:04 - down   (00:04)
shutdown system down  2.6.18-8.1.10.el Fri Oct 12 22:25 - 15:08 (3+16:43)

Hope this helped, drop me a comment if you need info.