'last' command help you do the system analysis

 

Last can list the users’ login/logout. The  pseudo user reboot logs in each time the system is rebooted.

Use last command, it can help with you:

1, list all the system reboots or crash time. The information is very useful when OMlog is overwritten.

2, who, when and from where the user login to the sytem.

 

ATCA29-0-0-1:/root-#last reboot

reboot   system boot  2.6.18-274.el5   Sun Oct 30 13:35          (23:58)

reboot   system boot  2.6.18-274.el5   Sun Oct 30 04:37         (1+08:56)

reboot   system boot  2.6.18-274.el5   Sat Oct 29 19:38         (1+17:55)

reboot   system boot  2.6.18-274.el5   Fri Oct 28 16:12         (2+21:21)

reboot   system boot  2.6.18-274.el5   Thu Oct 27 16:14         (3+21:19)

reboot   system boot  2.6.18-274.el5   Thu Oct 27 11:20         (4+02:13)

reboot   system boot  2.6.18-274.el5   Thu Oct 27 10:51         (4+02:42)

reboot   system boot  2.6.18-274.el5   Fri Oct 21 09:16         (10+04:17)

…

 

ATCA29-0-0-1:/root-#last

root     pts/0        atca29-0-0-9     Mon Oct 31 13:24   still logged in

reboot   system boot  2.6.18-274.el5   Sun Oct 30 13:35          (23:49)

reboot   system boot  2.6.18-274.el5   Sun Oct 30 04:37         (1+08:47)

reboot   system boot  2.6.18-274.el5   Sat Oct 29 19:38         (1+17:45)

reboot   system boot  2.6.18-274.el5   Fri Oct 28 16:12         (2+21:12)

ainet    pts/0        bjlinc1079.cn.al Fri Oct 28 16:10 - crash  (00:01)

ainet    pts/7        bjlinc1046.cn.al Fri Oct 28 14:21 - 16:10  (01:49)

…

ainet    pts/0        135.252.181.79   Thu Oct 20 21:32 - crash  (00:06)

reboot   system boot  2.6.18-274.el5   Thu Oct 20 21:28         (10+15:55)

ainet    pts/11       bjlinc1079.cn.al Thu Oct 20 20:46 - 21:26  (00:39)

ainet    pts/10       bjlinc1079.cn.al Thu Oct 20 20:43 - 21:26  (00:42)

…

ainet    pts/1        bjlinc1229.cn.lu Thu Oct 20 12:57 - down   (00:01)

ainet    pts/0        135.252.181.229  Thu Oct 20 11:39 - down   (01:20)

..

wtmp begins Fri Sep 30 16:08:21 2011