last oferece as seguintes opções para isso:
-s, --since time
Display the state of logins since the specified time. This is useful, e.g., to easily determine who was logged in at a particular time.
The option is often combined with --until.
-t, --until time
Display the state of logins until the specified time.
-p, --present time
Display the users who were present at the specified time. This is like using the options --since and --until together with the same time.
Sobre o formato time , a manpage diz:
The options that take the time argument understand the following formats:
YYYYMMDDhhmmss
YYYY-MM-DD hh:mm:ss
YYYY-MM-DD hh:mm (seconds will be set to 00)
YYYY-MM-DD (time will be set to 00:00:00)
hh:mm:ss (date will be set to today)
hh:mm (date will be set to today, seconds to 00)
now
yesterday (time is set to 00:00:00)
today (time is set to 00:00:00)
tomorrow (time is set to 00:00:00)
+5min
-5days
Aqui alguns exemplos:
last -s 2017-08-04 # from 2017-08-04 until today
last -s yesterday -t -120min # from yesterday until two hours ago
last -s -4days -t -2days # from four days ago until two days ago
last -p 2017-08-04 # users present at 2017-08-04 00:00:00
Leia mais sobre last e suas opções na página de manual .