# (Auditing) last command output

## feiticeir0

Hi all!

I'm doing a research for a report and i've trying to understand the last command output.

Somethings is straight forward, but there still some columns in the output of the command that i can't understand and my research in the internet didn't get me anything...

Here is a sample:

```

bvsantos pts/1        :0.0             Wed Mar  3 09:24 - 09:39  (00:15)    

bvsantos pts/0        :0.0             Wed Mar  3 09:24 - 09:38  (00:14)    

bvsantos :0                            Wed Mar  3 09:08 - 12:30 (12+03:21)  

reboot   system boot  2.6.32-zen6      Wed Mar  3 09:11 - 09:42 (26+23:30)  

bvsantos pts/5        :0.0             Tue Mar  2 15:21 - 15:29  (00:08)    

bvsantos pts/4        :0.0             Tue Mar  2 15:18 - 15:26  (00:07)    

bvsantos pts/4        :0.0             Tue Mar  2 14:51 - 14:55  (00:04)    

bvsantos pts/3        :0.0             Tue Mar  2 14:46 - 18:08  (03:21)    

```

The first column is my username. The second one is the console. The third one means is local.

The next columns are the date.

My problem is the last one. For some lines it's obvious, it's the session duration time, but this one: (12+03:21)  

What does it means ? what is 12+ ???

cheers,

Bruno

----------

## malern

 *feiticeir0 wrote:*   

> 
> 
> My problem is the last one. For some lines it's obvious, it's the session duration time, but this one: (12+03:21)  
> 
> What does it means ? what is 12+ ???

 

12 days. So that session was logged in 12 days, 3 hours, 21 minutes.

----------

## feiticeir0

Thx for the reply.

So, it means i start the session at March 3rd at 09:08 and last until March, 15th, 12:30 ?

----------

## malern

Yes, you can also use "last -F" to make it explicitly show you the session start and end times.

----------

## feiticeir0

Thank you all for the replys !

I understand now !

Cheers,

Bruno Santos

----------

