lastlog

• Shows last login per user (one entry per account)
• Different from wtmp → not history, just latest login

Username   Port   From             Latest
root       pts/0  192.168.1.10     Fri Apr  3 10:15:22 +0300 2026
user1      pts/1  10.0.0.5         Fri Apr  2 09:10:11 +0300 2026

last

shows login history (from /var/log/wtmp)

user1   pts/0   192.168.1.10   Fri Apr  3 10:15 - 10:45  (00:30)
root    pts/1   10.0.0.5       Fri Apr  3 09:50 - 10:10  (00:20)
reboot  system boot           Fri Apr  3 09:40

• last -a
• last reboot

lastb

reads /var/log/btmp (failed logins)

who

reads /var/log/utmp - current logged-in users (session + IP)

user1 pts/0 2026-04-03 10:15 (192.168.1.10)