Category: Utility Scripts
Author/Contact Info merlyn
Description: View the last login times of everyone on your system. You may need to adjust the struct for unpacking or the location of your lastlog file. 
open LASTLOG, "/var/log/lastlog" or die; # location may vary
my $struct_lastlog = "L a8 a256"; # see "man lastlog" for struct sizes
my $size = length pack $struct_lastlog, 0, "", "";

while (my($user, $pwd, $uid) = getpwent) {
  next unless seek LASTLOG, $size * $uid, 0;
  next unless read(LASTLOG, my $buf, $size) == $size;
  my ($time, $line, $host) = unpack $struct_lastlog, $buf;
  s/\0*$// for $line, $host; # trim NULs
  next unless $time;
  printf "%8s %5d %30s %8s %s\n", $user, $uid, scalar localtime $time,
+ $line, $host;
}
Replies are listed 'Best First'.
&cow;Re: View last login times of everyone on your system
by Roy Johnson (Monsignor) on Jan 15, 2004 at 19:49 UTC
    Which systems is this for? On my Solaris (5.8) machine, there's no lastlog in the man pages or in /var/log/. But we do have a handy utility called "last", which makes this fairly easy: 
    open(LASTLOG, 'last|') or die "Try Randal's script instead: $!\n";
my %logins;
while (<LASTLOG>) {
    my ($name, $from) = split ' ', $_, 3;
    print unless $from eq 'ftp' or $logins{$name}++;
}

    [download]
    Or go with the command-line one-liner: last | perl -lane 'print unless $F[1] eq "ftp" or $logins{$F[0]}++' Caveat: there may be other connections you want to exclude besides ftp. Season to taste.
    The PerlMonk tr/// Advocate
[reply]
[d/l]
[select]
      BSD-derived systems generally have both last and lastlog, and they do different things. Generally the log used by last is truncated routinely, so you won't get history back to day one, whereas the /var/log/lastlog file is also the file used by login to tell you when you last logged in, so it never gets truncated.

      -- Randal L. Schwartz, Perl hacker
      Be sure to read my standard disclaimer if this is a reply.

[reply]
        Thanks. For others who don't have helpful man pages: on Solaris, at least, it's in /var/adm, and the structure of the file can be deciphered from /usr/include/lastlog.h: my $struct_lastlog = "L a8 a16";
        The PerlMonk tr/// Advocate
[reply]
[d/l]
Re: View last login times of everyone on your system
by gellyfish (Monsignor) on Jan 19, 2004 at 16:06 UTC

    Alternatively you might look at the program plastlogin that comes with Sys::Lastlog - this module is XS based and should work on all systems that have /var/log/lastlog or it's equivalent, but I would be happy to apply patches for systems where it doesn't work

    /J\

[reply]
[d/l]
Re: View last login times of everyone on your system
by zentara (Cardinal) on Jan 19, 2004 at 15:32 UTC
    Hi, I finally got around to trying this script on my Linux system, and it has a problem where it only reports for root UID 0. When running the script: 
    root     0       Mon Jan 19 09:02:58 2004     tty1

    [download]
    but when I run "lastlog -u zentara" I can get 
    zentara    tty6           Mon Jan 19 09:03:13 -0500 2004

    [download]
    in addition to root. I tried messing with your script, but had no luck. Any reason why?
[reply]
[d/l]
[select]
      On Linux, the lastlog.h is different. Since I don't have access to a Linux system, I can't look there, but you need to examine the header file and figure out the right sizes for the struct. Apparently it's not "8" and "256".

      -- Randal L. Schwartz, Perl hacker
      Be sure to read my standard disclaimer if this is a reply.

[reply]
        OK, on linux it's 
        my $struct_lastlog = "L a32 a256";

        [download]
[reply]
[d/l]

Back to Code Catacombs