last - Enhanced Login History

The last module provides a highly flexible way to view system login history, supporting interactive exploration, tree-based grouping by reboot, and structured data exports (JSON/CSV).

When to Activate

• When the user wants to audit recent system login and logout activity.
• When checking system reboot history in a structured format.
• When performing interactive analysis of user sessions in a TTY.
• When exporting login records for security reporting or external analysis.

Core Principles & Rules

• Interactive Browsing: Default behavior in TTY is an interactive selector for records.
• Tree View: Use --tree to group sessions by the reboot events that preceded them.
• Structured Formats: Support for -j (JSON) and -c (CSV) for easy parsing.

Patterns & Examples