Linux get last command

last command in Linux with Examples

The last command in Linux is used to display the list of all the users logged in and out since the file /var/log/wtmp was created. One or more usernames can be given as an argument to display their login in (and out) time and their host-name.

Syntax:

Example:

Options:

Example:

Output:

-R: This option is used to hide the host-name field.

Example:

-F: This option is used to display the login and logout time including the dates.

Example:

-a: This option is used is to display the host-name in the last column.

Example:
-s, -t: This option is used to display within a specific time period.(-s) since and (-t) until, these commands are used to frame the time period.

Example:

The valid formats for the above commands are:
-d: This option is used to translate the IP address back into its host-name.

Example:
-x: This option is used to display information like system down entries and run level changes.

Example:
-w: This option is used to display full user and domain names.

Example:
–help: This option is used to display help regarding all options belonging to the last command.

Источник

Linux Last Command with Examples

Linux last command is used to check previously logged in user into your server. This command is very important in Linux as it helps for the audit trail. Assume that something is changed in the Linux system, in this situation you are not sure who has made the changes. Using the ‘last’ command you can identify who logged in at a particular time.

Last command displays a list of all user logged in and out from ‘/var/log/wtmp’ since the file was created. Wtmp is a log file that captures and records every login and logout event. This is a binary file that cannot view by any text editors. This trick is pretty smart because any user or root can not modify the file as they want.

Last command gives you information about the name of all users logged in, tty, IP Address (if the user doing a remote connection) date/time, and how long the user logged in.

How to run Last command

You just need to type ‘last’ on your console.

Here’s the sample:

Here’s how to read last information:

The first column — name of the user who has logged in.

The second column — give us information about how the user is connected ( via pts or tty). Exception for reboot activity the status will be shown as ‘system boot’.

The third column — shows where the user connected from. If the user connect from remote computer, you will see a hostname or an IP Address. If you see :0.0 or nothing it means that the user is connect via local terminal. Exception for reboot activity, the kernel version will be shown as the status.

The remaining columns — displays login time and data stamp when the log activity has happened. Numbers in the bracket tell us how many hours and minutes the connection was happened.

pts (pseudo terminal) — means that the user connect via remote connections such as SSH or telnet.
tty (teletypewriter) — means that the user connect via direct connection to the computer or local terminal.

1. Limit number of lines

When you have a lot of lines to show, you can limit how many lines do you want to see using -n option.

In the following command it will display 3 lines starting from the current time and backwards.

2. Hide hostname/IP Address

Use -R option to hide hostname or ip address from printing.

3. Display hostname in last column

Sometimes it’s easy to print hostname or ip address at the last column. To do this, you can use -a option as shown below:

4. Print full login and logout time and dates

By default, last command won’t show full date and time. You can use -F option for this.

5. Search between specific dates

You can use -s (since) and -t (until) options to search logs between specific dates.

For example, the following command will print logs from 1st February to 1st May 2019.

6. Print specific user name

If you want to trace specific user, you can print it specifically. Put the name of user with last command.

Or if you want to know when reboot is done, you can also display it

7. Print specific tty/pts

Last can also print information about specific tty/pts. Just put the tty name or pty name behind the last command.

When you see down value in brackets, it means that the user was logged in from specific time until the system is reboot or shutdown.

8. Use another file than /var/log/wtmp

By default, last command will parse information from ‘/var/log/wtmp’. If you want the last command parse from another file, you can use -f parameter.

For example, you may rotate the log after a certain condition. Let’s say the previous file is named ‘/var/log/wtmp.1’ .

Then the last command will look as following:

9. Display the run level changes

There is -x option, if you want to display run level changes.

Here’s a sample output:

You can see that there are two entries of run level. Runlevel which has to lvl 3 entry means the system is running on full console mode. No active X Window or GUI. Meanwhile, when the system is shutdown, Linux us run level 0. That’s why last show you to lvl 0 entry.

To display the last shutdown date and time, use the following command:

10. View bad logins

While last command logs successful logins, then lastb command record failed login attempts. You must have root access to run lastb command. Lastb will parse information from /var/log/btmp.

Here’s a sample output from lastb command.

11. Display locahost IP address

With -d option (for non-local logins), linux stores not only the host name of the remote host but also its IP number.

12. Rotate wtmp logs

Since ‘/var/log/wtmp’ record every single log in activities, the size of the file may grow quickly. By default, Linux will rotate ‘/var/log/wtmp’ every month. The detail of rotation activity is put in /etc/logrotate.conf file.

Here’s the content of my ‘/etc/logrotate.conf’ file.

And for ‘/var/log/btmp’, here’s default configuration of rotate activity

Clear last command history

As we know that it writes to wtmp, so if we want to delete last history, then we can do it via

Conclusion

In this tutorial, we learned how to use last command in Linux to check logs from wtmp file. For more detail, please visit last manual page by typing man last on your console.

Источник

Different Ways To Repeat Your Last Command In Linux

Today, I will be teaching you how to repeat your last command in Linux. You don’t have to re-type the previously executed commands in your Shell. Of course, we use the UP arrow key to select the last executed commands and hit ENTER to execute them. However, there are also other a few ways to do this. There could be many ways to repeat the last commands in Unix-like systems, but these are the only ways I am aware of now. All these commands were tested in my Arch Linux and Ubuntu desktop with BASH shell.

A word of caution: When you try the following methods, the previously executed commands will run immediately. Just make sure your last command wasn’t any harmful like formatting a partition or deleting files, folders or any other important data.

Repeat last command in Linux

Let us run a few commands.

As I mentioned earlier, we can execute the last command by simply pressing the UP arrow and hit ENTER key. This is the most commonly used way by many users to execute the previous command. This method will work on all SHELL, regardless of the Linux distribution you use.

However, like I said already, there are a few other methods to do this.

Now, let me show you how to execute the last command with some practical examples.

Method 1 — Using exclamation marks

To execute any last executed command, just type double exclamation marks, and hit ENTER:

This will execute the last command. Sample output would be:

Add sudo in-front of !! to execute the last command as root user like below.

You can also use the following to execute the previous command as sudo user:

Sample output:

Cool, isn’t it? You don’t need to type the last command completely. It could be useful when you’ve already executed a very long command, and don’t want to re-type the same command again.

Method 2 — Repeat N-th command

You might have run so many commands, and want to repeat a specific command. What will you do? Simple! You can do this by typing a specific word of the previous command.

To repeat previous command that starts with a specific word/letter, for example un , just type:

The above command will execute last command that starts with the letters «un».

Sample output:

As you see in the above example, you don’t need to type the whole command (i.e uname -r ). Instead, just type a few letters of the command, and any previous command that contains words will run.

Also, If you know the full command name, just type it like below:

It will execute the last command.

What if you don’t want to repeat the last command, but just display it. Sometimes, you don’t want to run a command, but just retrieve it from the history. If so, find the prefix number of the command you want to run:

Sample output:

Let us say you want to retrieve the 1685th command, but don’t want to run it immediately, add :p next to the command like below.

This will display 1685th command from the history, but won’t execute it.

Method 3 — Using reverse-search

Another way to do this is by searching your command line history using CTRL+R . Press CTRL+R key to search through the command line history. I personally prefer this method. It searches history interactively which I think feels safer than executing commands blindly from the BASH history.

Have a look at the following example. In the following example, I searched for «ost» , which displayed the last command “sudo netctl restart ostechnixjio” in the history that contained the word «ost» . Then, I hit ENTER to execute the command immediately or right arrow key complete the command and hit ENTER key to execute it.

Just in case, you want to edit/modify the last command before executing it, just press the left arrow key, then edit the last command and hit ENTER to execute it. Some commands may start with same letters. In such cases, keep hitting the CTRL+R key to bring back the command you wanted to run.

Method 4 — Use hyphen symbol with command prefix numbers

Here is yet another way to run the previous command.

Sample output:

Similarly, !-2 will run the second last command, !-3 will run the third last command, and so on.

Method 5 — Using CTRL+p and CTRL+o

I don’t want to type any command manually. Is there any way to repeat a last command by simply pressing a particular key(s) in my Keyboard? Yes, of course!

Press CTRL+P to switch to the last command, and then press CTRL+O to execute it. This will do the wonder. No configuration needed! You can use CTRL+O as many times as you want to keep re-executing the last commands.

Method 6 — Using fc command

This is another way to repeat the last executed command. The fc command is used to list, edit and re-run the previously entered command.

To repeat the last command using fc, simply run:

Sample output:

Suggested read:

Method 7 — Using ALT+period key

As one of our reader said in the comment section, we can also use ALT+. keys (press ALT+period) to retrieve the last command without running it. However, there is one limitation. Hitting ALT+. will only retrieve the last argument in the command. For example, if your previous command is «uname -r» , it will only bring back the -r argument, but not the entire command.

And, that’s all. You know now how to repeat your last command without typing it in the Terminal. If you want to view the output of your last commands without actually having to retype them, these methods will help.

If you know any other methods, please let me know in the comment section below. I will check and update the guide accordingly.

You knew now how to repeat a previously executed command. How do you repeat a Linux command or program until it succeeds? Well, that’s easy! Refer the following guide for more details.

Источник

View history of commands run in terminal

Is there a way to save all my typed terminal commands and view it like history in a log book?

5 Answers 5

This is automatically done. Bash stores your commands in

/.bash_history . If you want to have a look at the history, either print the output of this file using one of

Or you can use bash’s builtin command:

To clear the history, delete the file and clear the temp history:

The history size defaults to 500 commands. You can, however, increase this by adding a line to your

/.bashrc file to set the HISTSIZE variable:

This will not take effect immediately, but only to newly started sessions. To apply this, re-source the .bashrc file:

or run HISTSIZE=. in your current session.

You can type history on a terminal to view all the previous executed commands.

You can truncate the output to some lines (where 5 is the number of lines):

If do you want to view only commands containing a string (i.e. mv ), you can do this:

You can recall a command by typing ! followed by the entry number.

Let’s say that I have a history like this:

• To run mkdir foo , you can type !2 .
• To run the last command, you can use !-1 or !!
• To run the penultimate, you can use !-2

If you run a command that fails because it needs root privileges (i.e. touch /etc/foo ), you can use sudo !! to run the last command as root.

• If you type !man you will execute the last command that begins with man
• If do you type !?man? it will execute the last command that contains man (not neccessarily at the line begin)

If do you have a typo in a command, you can fix it this way. Let’s say that I type cat .bash_hi , to replace .bash_hi by .bash_history I only need to type ^hi^history^ .

Источник