As an example if you execute last without any parameters you might see something like the below:
[root@temmpnode ~]# last -a opc pts/3 Fri Mar 17 08:42 still logged in 220.127.116.11 opc pts/3 Fri Mar 17 07:45 - 07:45 (00:00) 18.104.22.168 opc pts/2 Fri Mar 17 07:14 - 09:24 (02:10) 22.214.171.124 opc pts/1 Fri Mar 17 07:09 still logged in 126.96.36.199 opc pts/0 Fri Mar 17 07:03 still logged in 188.8.131.52
The last command has a number of parameters that can make your life more easy when trying to find out who did log into the system.
Tells last to use a specific file instead of /var/log/wtmp.
This is a count telling last how many lines to show.
The same as -num
Display the state of logins as of the specified time. This is useful, e.g., to determine easily who was logged in at a particular time -- specify that time with -t and look for "still logged in".
Specifies a file to search other than /var/log/wtmp.
Suppresses the display of the hostname field.
Display the hostname in the last column. Useful in combination with the next flag.
For non-local logins, Linux stores not only the host name of the remote host but its IP number as well. This option translates the IP number back into a hostname.
Print full login and logout times and dates.
This option is like -d in that it displays the IP number of the remote host, but it displays the IP number in numbers-and-dots notation.
Read an old-type wtmp file (written by linux-libc5 applications).
Display full user and domain names in the output.
Display the system shutdown entries and run level changes.