# lastb是last的软链接,只显示登录失败的记录 $ ll /usr/bin/last* -rwxr-xr-x. 1 root root 19568 Jun 10 2014 /usr/bin/last lrwxrwxrwx. 1 root root 4 Nov 27 05:42 /usr/bin/lastb -> last -rwxr-xr-x. 1 root root 19608 Aug 9 2019 /usr/bin/lastlog # 最后一行会显示该wtmp文件的创建时间,即记录的起始时间 $ last root pts/1 192.168.80.1 Sun Feb 28 10:11 still logged in root pts/0 192.168.80.1 Sun Feb 28 10:11 still logged in reboot system boot 3.10.0-1160.11.1 Sun Feb 28 10:10 - 10:20 (00:09) root pts/0 192.168.80.1 Sat Feb 27 09:19 - crash (1+00:51) root pts/0 192.168.80.1 Fri Feb 26 16:35 - 21:26 (04:50) reboot system boot 3.10.0-1160.11.1 Fri Feb 26 15:58 - 10:20 (1+18:21) root pts/1 192.168.80.1 Fri Feb 26 15:51 - down (00:06) root pts/1 192.168.80.1 Fri Feb 26 15:34 - 15:51 (00:17) ... usera pts/1 192.168.80.1 Fri Feb 5 21:41 - 21:41 (00:00) usera pts/1 192.168.80.1 Fri Feb 5 21:40 - 21:41 (00:00) wtmp begins Fri Nov 27 05:47:49 2020 # -f指定文件,如复制其他主机的wtmp文件到本机查看 # -n5只查看最近的5条记录 $ last -n5 -f wtmp root pts/1 192.168.80.1 Sun Feb 28 10:11 still logged in root pts/0 192.168.80.1 Sun Feb 28 10:11 still logged in reboot system boot 3.10.0-1160.11.1 Sun Feb 28 10:10 - 10:49 (00:38) root pts/0 192.168.80.1 Sat Feb 27 09:19 - crash (1+00:51) root pts/0 192.168.80.1 Fri Feb 26 16:35 - 21:26 (04:50) # -R不显示登录者的主机名或IP $ last -n5 -R root pts/1 Sun Feb 28 10:11 still logged in root pts/0 Sun Feb 28 10:11 still logged in reboot system boot Sun Feb 28 10:10 - 10:52 (00:41) root pts/0 Sat Feb 27 09:19 - crash (1+00:51) root pts/0 Fri Feb 26 16:35 - 21:26 (04:50) wtmp begins Fri Nov 27 05:47:49 2020 # -a将登录者的主机名或IP显示在最后一列 $ last -n5 -a root pts/1 Sun Feb 28 10:11 still logged in 192.168.80.1 root pts/0 Sun Feb 28 10:11 still logged in 192.168.80.1 reboot system boot Sun Feb 28 10:10 - 10:52 (00:41) 3.10.0-1160.11.1.el7.x86_64 root pts/0 Sat Feb 27 09:19 - crash (1+00:51) 192.168.80.1 root pts/0 Fri Feb 26 16:35 - 21:26 (04:50) 192.168.80.1 wtmp begins Fri Nov 27 05:47:49 2020 # -t显示指定时间之前的记录,注意时间格式 $ last -n5 -t 20210115080000 root pts/0 192.168.80.1 Mon Jan 11 12:47 - down (00:00) reboot system boot 3.10.0-1160.11.1 Mon Jan 11 12:46 - 12:47 (00:00) root pts/0 192.168.80.1 Mon Jan 11 12:39 - down (00:02) reboot system boot 3.10.0-1160.11.1 Mon Jan 11 12:39 - 12:42 (00:02) reboot system boot 3.10.0-1160.11.1 Mon Jan 11 12:38 - 12:42 (00:04) # -F显示完整的登录和退出时间 $ last -n5 -F root pts/1 192.168.80.1 Sun Feb 28 10:11:13 2021 still logged in root pts/0 192.168.80.1 Sun Feb 28 10:11:04 2021 still logged in reboot system boot 3.10.0-1160.11.1 Sun Feb 28 10:10:57 2021 - Sun Feb 28 10:57:16 2021 (00:46) root pts/0 192.168.80.1 Sat Feb 27 09:19:54 2021 - crash (1+00:51) root pts/0 192.168.80.1 Fri Feb 26 16:35:42 2021 - Fri Feb 26 21:26:32 2021 (04:50) # -x显示tty和系统运行级别 root pts/1 192.168.80.1 Sun Feb 28 10:11 still logged in root pts/0 192.168.80.1 Sun Feb 28 10:11 still logged in runlevel (to lvl 3) 3.10.0-1160.11.1 Sun Feb 28 10:11 - 10:58 (00:47) reboot system boot 3.10.0-1160.11.1 Sun Feb 28 10:10 - 10:58 (00:47) root pts/0 192.168.80.1 Sat Feb 27 09:19 - crash (1+00:51) ... runlevel (to lvl 3) 3.10.0-1160.11.1 Sat Feb 20 15:11 - 13:55 (4+22:44) reboot system boot 3.10.0-1160.11.1 Sat Feb 20 15:11 - 15:58 (6+00:46) shutdown system down 3.10.0-1160.11.1 Fri Feb 19 15:11 - 15:11 (1+00:00) # 查看指定用户的登录记录 $ last usera usera pts/1 192.168.80.1 Fri Feb 5 21:41 - 21:41 (00:00) usera pts/1 192.168.80.1 Fri Feb 5 21:40 - 21:41 (00:00) # 查看系统重启记录 $ last reboot reboot system boot 3.10.0-1160.11.1 Sun Feb 28 10:10 - 10:25 (00:14) reboot system boot 3.10.0-1160.11.1 Fri Feb 26 15:58 - 10:25 (1+18:26) reboot system boot 3.10.0-1160.11.1 Thu Feb 25 13:55 - 15:58 (1+02:02) reboot system boot 3.10.0-1160.11.1 Sat Feb 20 15:11 - 15:58 (6+00:46) # lastb显示登录失败的记录,读取的是/var/log/btmp文件 $ lastb root ssh:notty 192.168.80.1 Sun Feb 7 20:14 - 20:14 (00:00) usera ssh:notty 192.168.80.1 Sun Feb 7 20:13 - 20:13 (00:00) usera ssh:notty 192.168.80.1 Fri Feb 5 21:41 - 21:41 (00:00) # last和lastb两个命令的选项可以通用 $ lastb -a root ssh:notty Sun Feb 7 20:14 - 20:14 (00:00) 192.168.80.1 usera ssh:notty Sun Feb 7 20:13 - 20:13 (00:00) 192.168.80.1 usera ssh:notty Fri Feb 5 21:41 - 21:41 (00:00) 192.168.80.1 usera ssh:notty Fri Feb 5 21:40 - 21:40 (00:00) 192.168.80.1 usera ssh:notty Fri Feb 5 21:39 - 21:39 (00:00) 192.168.80.1 # wtmp和btmp的文件格式不同 $ cp /var/log/wtmp /var/log/btmp . $ file wtmp btmp wtmp: data btmp: DBase 3 index file # 使用last读取btmp文件则显示的记录有误 $ last -f btmp root ssh:notty 192.168.80.1 Sun Feb 7 20:14 gone - no logout usera ssh:notty 192.168.80.1 Sun Feb 7 20:13 - 20:14 (00:00) usera ssh:notty 192.168.80.1 Fri Feb 5 21:41 - 20:13 (1+22:32) usera ssh:notty 192.168.80.1 Fri Feb 5 21:40 - 21:41 (00:00) usera ssh:notty 192.168.80.1 Fri Feb 5 21:39 - 21:40 (00:00) # 正确记录如下 $ lastb -f btmp root ssh:notty 192.168.80.1 Sun Feb 7 20:14 - 20:14 (00:00) usera ssh:notty 192.168.80.1 Sun Feb 7 20:13 - 20:13 (00:00) usera ssh:notty 192.168.80.1 Fri Feb 5 21:41 - 21:41 (00:00) usera ssh:notty 192.168.80.1 Fri Feb 5 21:40 - 21:40 (00:00) usera ssh:notty 192.168.80.1 Fri Feb 5 21:39 - 21:39 (00:00)