Linux自学之旅-基础命令（系统痕迹之last命令）
文章目录
前言
1.上一节我们讲述了查看正在登录的用户的信息命令who，还没看的可点击下方链接进入查看：who命令
2.这一节我们讲述一个查看系统所有登录过的用户的信息命令last
提示：以下是本篇文章正文内容
一、last命令格式
- 命令名称：last
- 命令全称：show listing of last logged in users
- 所在路径：/usr/bin/last
- 执行权限：所有用户
- 功能描述：查看系统所有登录过的用户信息
命令格式
[root@ecs-FWxC8 ~]# last
二、last使用
[root@ecs-FWxC8 ~]# last <-直接敲last即可
（用户名）（终端） （来源IP地址） （登录时间） - （退出时间）
root pts/1 220.202.207.99 Sun Mar 28 12:43 still logged in
root pts/1 220.202.152.39 Fri Mar 26 08:30 - 11:42 (03:11)
root pts/2 220.202.207.99 Thu Mar 25 22:23 - 22:48 (00:24)
root pts/1 220.202.207.99 Thu Mar 25 22:04 - 00:34 (02:30)
root pts/2 220.202.152.80 Thu Mar 25 12:08 - 14:41 (02:32)
root pts/3 220.202.152.80 Thu Mar 25 11:11 - 12:08 (00:56)
jh pts/3 220.202.152.80 Thu Mar 25 09:58 - 10:59 (01:01)
jh pts/2 220.202.152.80 Thu Mar 25 08:35 - 11:25 (02:49)
root pts/1 220.202.152.80 Thu Mar 25 08:34 - 12:10 (03:35)
root pts/1 119.39.248.60 Wed Mar 24 14:28 - 17:34 (03:06)
root pts/1 119.39.248.60 Wed Mar 24 12:09 - 13:28 (01:19)
root pts/0 119.39.248.60 Wed Mar 24 11:16 - 12:00 (00:44)
root pts/0 119.39.248.60 Wed Mar 24 10:45 - 11:15 (00:30)
root pts/0 119.39.248.60 Wed Mar 24 10:31 - 10:45 (00:13)
（reboot系统重启信息记录）
reboot system boot 3.10.0-957.12.2. Wed Mar 24 10:31 - 12:47 (4+02:16)
root tty1 Wed Mar 25 12:31 - 12:33 (00:01)
reboot system boot 3.10.0-957.12.2. Wed Mar 25 12:30 - 12:33 (00:03)
root tty1 Wed Mar 25 11:43 - 11:44 (00:01)
root pts/0 149.129.112.39 Wed Mar 25 11:42 - down (00:02)
root pts/0 149.129.112.39 Wed Mar 25 11:42 - 11:42 (00:00)
root pts/0 149.129.112.39 Wed Mar 25 11:34 - 11:42 (00:07)
reboot system boot 3.10.0-957.12.2. Wed Mar 25 11:34 - 11:44 (00:10)
root pts/0 149.129.112.39 Wed Mar 25 11:30 - down (00:03)
reboot system boot 3.10.0-957.12.2. Wed Mar 25 11:29 - 11:33 (00:04)
root tty1 Wed Mar 25 10:50 - 11:28 (00:38)
reboot system boot 3.10.0-957.12.2. Wed Mar 25 10:49 - 11:29 (00:39)
root tty1 Wed Mar 25 10:37 - crash (00:12)
reboot system boot 3.10.0-957.12.2. Wed Mar 25 10:36 - 11:29 (00:52)
root tty1 Wed Mar 25 10:35 - crash (00:01)
reboot system boot 3.10.0-957.12.2. Wed Mar 25 10:23 - 11:29 (01:05)
root tty1 Wed May 30 10:54 - 10:54 (00:00)
reboot system boot 3.10.0-957.12.2. Wed May 30 10:51 - 10:55 (00:03)
root pts/0 192.168.1.13 Tue Jul 30 15:22 - down (00:01)
reboot system boot 3.10.0-957.12.2. Wed May 30 10:42 - 15:23 (426+04:41)
root pts/0 192.168.0.244 Wed May 30 09:30 - down (00:00)
reboot system boot 3.10.0-957.12.2. Wed May 30 09:30 - 09:31 (00:01)
root pts/0 192.168.0.244 Wed May 30 09:27 - down (00:00)
reboot system boot 3.10.0-957.12.2. Wed May 30 09:26 - 09:28 (00:01)
root pts/1 192.168.1.13 Tue Jul 30 14:01 - crash (-426+-4:-35
root pts/1 192.168.1.13 Tue Jul 30 14:01 - 14:01 (00:00)
root pts/0 192.168.0.244 Tue Jul 30 13:57 - crash (-426+-4:-30
reboot system boot 3.10.0-957.12.2. Wed May 30 09:19 - 09:28 (00:09)
root pts/1 192.168.1.13 Tue Jul 30 13:52 - 13:54 (00:01)
root pts/0 192.168.1.13 Wed May 30 09:08 - crash (00:10)
reboot system boot 3.10.0-957.12.2. Wed May 30 09:07 - 09:28 (00:20)
root tty1 Wed Jul 17 16:48 - 16:48 (00:00)
root tty1 Wed Jul 17 16:37 - 16:47 (00:09)
reboot system boot 3.10.0-957.12.2. Wed Jul 17 16:37 - 09:28 (-413+-7:-9)
root tty1 Mon Jun 10 15:16 - crash (37+01:21)
reboot system boot 3.10.0-957.12.2. Mon Jun 10 15:15 - 09:28 (-376+-5:-47
root tty1 Mon Jun 10 15:05 - crash (00:09)
reboot system boot 3.10.0-957.12.2. Mon Jun 10 15:05 - 09:28 (-376+-5:-37
root tty1 Mon Jun 10 15:00 - 15:05 (00:05)
reboot system boot 3.10.0-957.12.2. Mon Jun 10 14:59 - 15:05 (00:05)
root tty1 Mon Jun 10 14:31 - 14:53 (00:22)
reboot system boot 3.10.0-957.el7.x Mon Jun 10 14:31 - 14:53 (00:22)
root tty1 Mon Jun 10 14:28 - 14:30 (00:02)
reboot system boot 3.10.0-957.el7.x Mon Jun 10 14:27 - 14:53 (00:26)
wtmp begins Mon Jun 10 14:27:45 2019
总结
本节我们介绍了last这个命令，主要知道了其可以查看所有登录过的用户的信息这一功能。
我是结花，我们下次见！