last - macOS

Overview

The last command in macOS is used to display a list of all the users who have logged in (and out) on the system, as specified in the system’s log files. This command can be particularly useful for system administrators when auditing and monitoring user sessions for security and compliance purposes.

Syntax

last [options] [username...] [tty...]

Parameters:

  • username…: Optional. Specify one or more usernames to filter the output.
  • tty…: Optional. Specify terminal names to filter the output.

Options/Flags

  • -d: Show IP address instead of the hostname for remote logins.
  • -f file: Use a specific file instead of the default /var/log/wtmp.
  • -h: Display help about the command.
  • -n number: Show only the last ‘number’ of lines in the output.
  • -R: Suppresses the display of the hostname field.
  • -t yyyyMMddHHmmss: Display the records until the specified time.
  • -x: Include system shutdown entries and run level changes.

Examples

  1. Basic Usage: Display the recent login sessions. 
    last
  2. Limit Output: Display only the last 5 entries. 
    last -n 5
  3. Specific User: Show login records for user john. 
    last john
  4. Specific Terminal: Display logins from terminal tty0. 
    last tty0
  5. Combining multiple options: Display the last 10 logins from user john on terminal tty0. 
    last -n 10 john tty0

Common Issues

  • File not found: Errors like wtmp begins Mon Sep 7 04:02:13 2021 - no file occur when the log file is missing or corrupted. Ensure file integrity and permissions.
  • Time format confusion: Remember that the -t flag uses the precise format yyyyMMddHHmmss without any spaces or other delimiters.

Integration

The last command can be combined effectively with other unix commands. For example, to find out if a specific user logged in during a certain period, you can use:

last | grep 'username' | grep 'Jul'

This chain uses grep to filter output from last, searching first for entries relating to username, then refining that to entries from July.

  • who: Shows who is logged into the system at the moment.
  • w: Displays a summary of the current activity on the system including who is logged in, what they are doing, etc.
  • lastb: Shows a list of the bad login attempts.

Learn more about user monitoring commands by checking the official documentation here.