#Bash 的 lastlog 命令
lastlog [OPTION]
功能
报告用户最后一次登录的信息。
类型
可执行文件（/usr/bin/lastlog）。
参数
OPTION选项：-b,--before DAYS- 仅显示DAYS天以前的登录信息-C,--clear- 清除指定用户的登录记录；必须与-u选项一同使用-h,--help- 显示帮助-R,--root CHROOT_DIR- 使用CHROOT_DIR作为根目录；必须使用绝对路径-S,--set- 将指定用户上次登录日志记录的时间设为当前时间；必须与-u选项一同使用-t,--time DAYS- 仅显示最近DAYS天的登录信息-u,--user LOGIN- 指定用户
#示例
$ lastlog
Username Port From Latest
root **Never logged in**
daemon **Never logged in**
bin **Never logged in**
sys **Never logged in**
...
primers pts/19 192.168.1.100 Fri Feb 6 08:35:23 +0000 2026
...
#推荐阅读
#手册
LASTLOG(8) System Management Commands LASTLOG(8)
NAME
lastlog - reports the most recent login of all users or of a given user
SYNOPSIS
lastlog [options]
DESCRIPTION
lastlog formats and prints the contents of the last login log
/var/log/lastlog file. The login-name, port, and last login time will
be printed. The default (no flags) causes lastlog entries to be
printed, sorted by their order in /etc/passwd.
OPTIONS
The options which apply to the lastlog command are:
-b, --before DAYS
Print only lastlog records older than DAYS.
-C, --clear
Clear lastlog record of a user. This option can be used only
together with -u (--user)).
-h, --help
Display help message and exit.
-R, --root CHROOT_DIR
Apply changes in the CHROOT_DIR directory and use the configuration
files from the CHROOT_DIR directory. Only absolute paths are
supported.
-S, --set
Set lastlog record of a user to the current time. This option can
be used only together with -u (--user)).
-t, --time DAYS
Print the lastlog records more recent than DAYS.
-u, --user LOGIN|RANGE
Print the lastlog record of the specified user(s).
The users can be specified by a login name, a numerical user ID, or
a RANGE of users. This RANGE of users can be specified with a min
and max values (UID_MIN-UID_MAX), a max value (-UID_MAX), or a min
value (UID_MIN-).
If the user has never logged in the message ** Never logged in** will
be displayed instead of the port and time.
Only the entries for the current users of the system will be displayed.
Other entries may exist for users that were deleted previously.
NOTE
The lastlog file is a database which contains info on the last login of
each user. You should not rotate it. It is a sparse file, so its size
on the disk is usually much smaller than the one shown by "ls -l"
(which can indicate a really big file if you have in passwd users with
a high UID). You can display its real size with "ls -s".
CONFIGURATION
The following configuration variables in /etc/login.defs change the
behavior of this tool:
LASTLOG_UID_MAX (number)
Highest user ID number for which the lastlog entries should be
updated. As higher user IDs are usually tracked by remote user
identity and authentication services there is no need to create a
huge sparse lastlog file for them.
No LASTLOG_UID_MAX option present in the configuration means that
there is no user ID limit for writing lastlog entries.
FILES
/var/log/lastlog
Database times of previous user logins.
CAVEATS
Large gaps in UID numbers will cause the lastlog program to run longer
with no output to the screen (i.e. if in lastlog database there is no
entries for users with UID between 170 and 800 lastlog will appear to
hang as it processes entries with UIDs 171-799).
Having high UIDs can create problems when handling the <term>
/var/log/lastlog</term> with external tools. Although the actual file
is sparse and does not use too much space, certain applications are not
designed to identify sparse files by default and may require a specific
option to handle them.
shadow-utils 4.13 05/30/2024 LASTLOG(8)