Hey there! I’ve dealt with this weird last command behavior before, so let me walk you through what’s going on.

When you see a negative time value in the last output, it usually boils down to one of two common scenarios:

• System clock was adjusted recently: If someone (or a script) changed the system time to an earlier point, any active user sessions that were supposed to end at a "future" time (before the clock rollback) will show up with a negative duration. For example, if you set the clock back 10 minutes while a user is logged in, their session time will display as -00:10.
• Abnormally terminated sessions: Sometimes when a user’s connection drops abruptly (like a sudden network outage) or their terminal process gets force-killed, the system fails to properly record the session end time. This can mess up the duration calculation, resulting in a negative value.

Here’s what that might look like in your last output:

jane pts/2 192.168.0.45 Thu Oct 12 09:15 still logged in (-00:07)

A quick way to troubleshoot:

• Run date to check your current system time, then hwclock --show to compare it with the hardware clock—if they don’t match, that’s likely the culprit.
• Use the who command to list currently active users. If a session showing a negative time in last doesn’t appear in who, it’s probably a leftover from an abnormal disconnect.

备注：内容来源于stack exchange，提问作者3088 K