Category: |
Utility Scripts |
Author/Contact Info |
merlyn |
Description: |
View the last login times of everyone on your system. You may need to adjust the struct for unpacking or the location of your lastlog file. |
open LASTLOG, "/var/log/lastlog" or die; # location may vary
my $struct_lastlog = "L a8 a256"; # see "man lastlog" for struct sizes
my $size = length pack $struct_lastlog, 0, "", "";
while (my($user, $pwd, $uid) = getpwent) {
next unless seek LASTLOG, $size * $uid, 0;
next unless read(LASTLOG, my $buf, $size) == $size;
my ($time, $line, $host) = unpack $struct_lastlog, $buf;
s/\0*$// for $line, $host; # trim NULs
next unless $time;
printf "%8s %5d %30s %8s %s\n", $user, $uid, scalar localtime $time,
+ $line, $host;
}
|
&cow;Re: View last login times of everyone on your system
by Roy Johnson (Monsignor) on Jan 15, 2004 at 19:49 UTC
|
Which systems is this for? On my Solaris (5.8) machine, there's no lastlog in the man pages or in /var/log/. But we do have a handy utility called "last", which makes this fairly easy:
open(LASTLOG, 'last|') or die "Try Randal's script instead: $!\n";
my %logins;
while (<LASTLOG>) {
my ($name, $from) = split ' ', $_, 3;
print unless $from eq 'ftp' or $logins{$name}++;
}
Or go with the command-line one-liner:
last | perl -lane 'print unless $F[1] eq "ftp" or $logins{$F[0]}++'
Caveat: there may be other connections you want to exclude besides ftp. Season to taste.
The PerlMonk tr/// Advocate
| [reply] [Watch: Dir/Any] [d/l] [select] |
|
BSD-derived systems generally have both last and lastlog, and they do different things. Generally the log used by last is truncated routinely, so you won't get history back to day one, whereas the /var/log/lastlog file is also the file used by login to tell you when you last logged in, so it never gets truncated.
| [reply] [Watch: Dir/Any] |
|
| [reply] [Watch: Dir/Any] [d/l] |
Re: View last login times of everyone on your system
by gellyfish (Monsignor) on Jan 19, 2004 at 16:06 UTC
|
Alternatively you might look at the program plastlogin that comes with Sys::Lastlog - this module is XS based and should work on all systems that have /var/log/lastlog or it's equivalent, but I would be happy to apply patches for systems where it doesn't work
/J\
| [reply] [Watch: Dir/Any] [d/l] |
Re: View last login times of everyone on your system
by zentara (Archbishop) on Jan 19, 2004 at 15:32 UTC
|
Hi, I finally got around to trying this script on my Linux system, and it has a problem where it only reports for root UID 0. When running the script:
root 0 Mon Jan 19 09:02:58 2004 tty1
but when I run "lastlog -u zentara" I can get
zentara tty6 Mon Jan 19 09:03:13 -0500 2004
in addition to root.
I tried messing with your script, but had no luck. Any reason why?
| [reply] [Watch: Dir/Any] [d/l] [select] |
|
On Linux, the lastlog.h is different. Since I don't have access to a Linux system, I can't look there, but you need to examine the header file and figure out the right sizes for the struct. Apparently it's not "8" and "256".
| [reply] [Watch: Dir/Any] |
|
my $struct_lastlog = "L a32 a256";
| [reply] [Watch: Dir/Any] [d/l] |
|
|