last

The "last" command line tool is used for retrieving information about previous user logins and system shutdowns. It displays a list of recently logged in users, along with the corresponding login time and duration of their session. The output also includes information about system startups, shutdowns, and runlevel changes. It reads the data from the /var/log/wtmp file, which stores login records. One of the main applications of the "last" command is to investigate system activity and user login patterns. You can use additional command-line options like '-n' to specify the number of records to display. The "-f" flag can be used to specify an alternative file to read login records from. You can also filter the output based on a specific username or terminal using the "-s" and "-t" options respectively. The "last" command allows system administrators to track user logins, identify active sessions, and monitor system uptime. It is commonly used for security auditing, troubleshooting login issues, and managing user access to the system.