Last Command
UNIX command to see the last login
Hello, Mac enthusiasts! Today, we're diving into a powerful yet often overlooked command-line tool that comes pre-installed on your Mac: the 'last' command. This nifty utility allows you to view the login history on your Mac, which can be incredibly useful for security monitoring or just satisfying your curiosity.
What is the 'last' command?
The 'last' command is a Unix utility that reads the system's wtmp file, which keeps a record of all logins and logouts. It's a simple yet powerful tool for tracking user activity on your Mac.
How to use the 'last' command
Open Terminal (you can find it in Applications > Utilities or use Spotlight to search for it).
Type
lastand press Enter.You'll see a list of login sessions, starting with the most recent. Each line shows:
- Username
- Terminal or console used (e.g., console, ttys000)
- IP address (if logged in remotely)
- Login date and time
- Logout time (or "still logged in" if the session is active)
Useful variations
last -10: Shows only the last 10 login sessionslast username: Shows login history for a specific userlast reboot: Shows system reboot historylast -t YYYYMMDDHHMMSS: Shows logins before a specific date/timelast -F: Displays full login and logout times
Pro tip: Combining with other commands
You can combine 'last' with other Unix commands for more specific information. For example:
last | grep "root": Shows only root user loginslast | awk '{print $1}' | sort | uniq: Lists unique users who have logged in
Use GREP to see when the computer last crashed!
Why is this useful?
- Security: Regularly checking login history can help you spot unauthorized access attempts.
- Troubleshooting: It can help identify when issues started occurring.
- Usage patterns: Understand how and when your Mac is being used.
Remember, the 'last' command is just one of many powerful tools available in the macOS Terminal. Stay tuned for more tips on leveraging these hidden gems to supercharge your Mac experience!