last [-a] [-n number | -number] [-f filename] [name | tty]...
The last command looks in the /var/adm/wtmpx file, which records all logins and logouts, for information about a user, a terminal, or any group of users and terminals. Arguments specify names of users or terminals of interest. If multiple arguments are given, the information applicable to any of the arguments is printed. For example, last root console lists all of root's sessions, as well as all sessions on the console terminal. last displays the sessions of the specified users and terminals, most recent first, indicating the times at which the session began, the duration of the session, and the terminal on which the session took place. last also indicates whether the session is continuing or was cut short by a reboot.
The pseudo-user reboot logs in when the system is shutdown and when it reboots. Thus,
gives an approximate record of when the operating system instance was shutdown and when it rebooted. This can be used to calculate the availability of the operating system over time.
last with no arguments displays a record of all logins and logouts, in reverse order.
If last is interrupted, it indicates how far the search has progressed in /var/adm/wtmpx. If interrupted with a quit signal (generated by a CTRL−\), last indicates how far the search has progressed, and then continues the search.
The following options are supported:
Displays the hostname in the last column.
Uses filename as the name of the accounting file instead of /var/adm/wtmpx.
Limits the number of entries displayed to that specified by number. These options are identical; the – number option is provided as a transition tool only and is removed in future releases.
Date and time format is based on locale specified by the LC_ALL, LC_TIME, or LANG environments, in that order of priority.
See attributes(5) for descriptions of the following attributes: