Beefy Boxes and Bandwidth Generously Provided by pair Networks
Think about Loose Coupling
 
PerlMonks  

View last login times of everyone on your system

by merlyn (Sage)
on Jan 15, 2004 at 17:42 UTC ( [id://321621]=sourcecode: print w/replies, xml ) Need Help??
Category: Utility Scripts
Author/Contact Info merlyn
Description: View the last login times of everyone on your system. You may need to adjust the struct for unpacking or the location of your lastlog file.
open LASTLOG, "/var/log/lastlog" or die; # location may vary
my $struct_lastlog = "L a8 a256"; # see "man lastlog" for struct sizes
my $size = length pack $struct_lastlog, 0, "", "";

while (my($user, $pwd, $uid) = getpwent) {
  next unless seek LASTLOG, $size * $uid, 0;
  next unless read(LASTLOG, my $buf, $size) == $size;
  my ($time, $line, $host) = unpack $struct_lastlog, $buf;
  s/\0*$// for $line, $host; # trim NULs
  next unless $time;
  printf "%8s %5d %30s %8s %s\n", $user, $uid, scalar localtime $time,
+ $line, $host;
}
Replies are listed 'Best First'.
&cow;Re: View last login times of everyone on your system
by Roy Johnson (Monsignor) on Jan 15, 2004 at 19:49 UTC
    Which systems is this for? On my Solaris (5.8) machine, there's no lastlog in the man pages or in /var/log/. But we do have a handy utility called "last", which makes this fairly easy:
    open(LASTLOG, 'last|') or die "Try Randal's script instead: $!\n"; my %logins; while (<LASTLOG>) { my ($name, $from) = split ' ', $_, 3; print unless $from eq 'ftp' or $logins{$name}++; }
    Or go with the command-line one-liner: last | perl -lane 'print unless $F[1] eq "ftp" or $logins{$F[0]}++' Caveat: there may be other connections you want to exclude besides ftp. Season to taste.

    The PerlMonk tr/// Advocate
      BSD-derived systems generally have both last and lastlog, and they do different things. Generally the log used by last is truncated routinely, so you won't get history back to day one, whereas the /var/log/lastlog file is also the file used by login to tell you when you last logged in, so it never gets truncated.

      -- Randal L. Schwartz, Perl hacker
      Be sure to read my standard disclaimer if this is a reply.

        Thanks. For others who don't have helpful man pages: on Solaris, at least, it's in /var/adm, and the structure of the file can be deciphered from /usr/include/lastlog.h: my $struct_lastlog = "L a8 a16";

        The PerlMonk tr/// Advocate
Re: View last login times of everyone on your system
by gellyfish (Monsignor) on Jan 19, 2004 at 16:06 UTC

    Alternatively you might look at the program plastlogin that comes with Sys::Lastlog - this module is XS based and should work on all systems that have /var/log/lastlog or it's equivalent, but I would be happy to apply patches for systems where it doesn't work

    /J\

Re: View last login times of everyone on your system
by zentara (Archbishop) on Jan 19, 2004 at 15:32 UTC
    Hi, I finally got around to trying this script on my Linux system, and it has a problem where it only reports for root UID 0. When running the script:
    root 0 Mon Jan 19 09:02:58 2004 tty1
    but when I run "lastlog -u zentara" I can get
    zentara tty6 Mon Jan 19 09:03:13 -0500 2004
    in addition to root. I tried messing with your script, but had no luck. Any reason why?
      On Linux, the lastlog.h is different. Since I don't have access to a Linux system, I can't look there, but you need to examine the header file and figure out the right sizes for the struct. Apparently it's not "8" and "256".

      -- Randal L. Schwartz, Perl hacker
      Be sure to read my standard disclaimer if this is a reply.

        OK, on linux it's
        my $struct_lastlog = "L a32 a256";

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: sourcecode [id://321621]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others rifling through the Monastery: (4)
As of 2024-03-29 10:30 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found