# Last command alternative?

**URL:** <https://forum.openwrt.org/t/last-command-alternative/98548>\
**Category:** Installing and Using OpenWrt\
**Created:** [June 7, 2021, 11:40am UTC](https://forum.openwrt.org/t/last-command-alternative/98548 "2021-06-07T11:40:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vijay\_Raj](https://forum.openwrt.org/letter_avatar/vijay_raj/32/5_5575768a8748004e209b776fc1b2916d.png) [@Vijay\_Raj](https://forum.openwrt.org/u/Vijay_Raj)\
**Post date:** [June 7, 2021, 11:40am UTC](https://forum.openwrt.org/t/last-command-alternative/98548/1 "2021-06-07T11:40:51Z")

</div>

I want to know to display the recently logged in user, like the `last` command in linux. However, i am unable to find the `last` command. Can anyone suggest me the alternative for the `last` command in openwrt ??

Help is very much appreciated

---

<div class="post-metadata">

**Author:** ![vgaetera](https://forum.openwrt.org/user_avatar/forum.openwrt.org/vgaetera/32/113586_2.png) [@vgaetera](https://forum.openwrt.org/u/vgaetera)\
**Post date:** [June 7, 2021, 2:06pm UTC](https://forum.openwrt.org/t/last-command-alternative/98548/3 "2021-06-07T14:06:35Z")

</div>

OpenWrt uses only runtime logs to save flash resource:

> **[Logging messages](https://openwrt.org/docs/guide-user/base-system/log.essentials)**
>
> Logging messages This article relies on the following: \* Accessing OpenWrt WebUI \* Accessing OpenWrt CLI Introduction The OpenWrt system logging facility is an important debugging/monitoring capability. The standard logging facility is...

So, that feature is unreliable and therefore is stripped off:

> <https://github.com/openwrt/openwrt/blob/master/package/utils/busybox/Config-defaults.in#L1598-L1600>

> <https://github.com/openwrt/openwrt/blob/master/package/network/services/dropbear/Makefile#L88-L92>

And it requires to recompile the related packages to enable the feature, otherwise you can get only:

```bash
logread -e dropbear

```

---

<div class="post-metadata">

**Author:** ![pavelgl](https://forum.openwrt.org/user_avatar/forum.openwrt.org/pavelgl/32/33073_2.png) [@pavelgl](https://forum.openwrt.org/u/pavelgl)\
**Post date:** [June 7, 2021, 2:39pm UTC](https://forum.openwrt.org/t/last-command-alternative/98548/4 "2021-06-07T14:39:45Z")

</div>

You can get an output, almost similar to the linux command “last” using a script.

```
cat << "EOF" > /root/last
#!/bin/sh
logread -e dropbear | grep 'Password auth succeeded for' | sed 's/^.* dropbear\[//' | sed 's/\]:.*//' | sort -u > /tmp/procids

successfullogins="/tmp/procids"

while IFS= read -r procid
do
user=$(logread -e "$procid" | grep 'Password auth succeeded for' | sed 's/^.*succeeded for //' | sed 's/ from.*//')
ip=$(logread -e "$procid" | grep 'Password auth succeeded for' | sed 's/^.*from //' | sed 's/\:.*//')
starttime=$(logread -e "$procid" | grep 'Password auth succeeded for' | sed 's/authpriv.*//' | sed 's/ from.*//')
endtime=$(logread -e "$procid" | grep 'Exited normally' | sed 's/authpriv.*//' | sed 's/ from.*//')
if [-z "$endtime"]; then
endtime="still logged in"
fi
echo -e "$user\t$ip\t$starttime"- "$endtime"
done < "$successfullogins"
exit 0
EOF
chmod 755 /root/last

```

```
root@OpenWrt:~# /root/last
'root' 192.168.2.135 Mon Jun 7 14:44:58 2021 - Mon Jun 7 15:21:42 2021
'root' 192.168.2.135 Mon Jun 7 15:21:13 2021 - Mon Jun 7 15:21:16 2021
'root' 192.168.2.135 Mon Jun 7 15:22:02 2021 - Mon Jun 7 17:05:10 2021
'root' 192.168.2.135 Mon Jun 7 16:31:55 2021 - Mon Jun 7 17:04:41 2021
'root' 192.168.2.135 Mon Jun 7 17:08:24 2021 - Mon Jun 7 17:33:35 2021
'root' 192.168.2.135 Mon Jun 7 17:15:01 2021 - Mon Jun 7 17:33:25 2021
'root' 192.168.2.135 Mon Jun 7 17:33:50 2021 - still logged in

```

Tested with 19.07.7