The 'last' command looks doable. It works on Linux, (Redhat and Slackware), Unixware and an ancient Ultrix we have here. You could split on the output of 'last' looking for "ftp" and a "still logged in" line. If your utmp file is huge, you might might want to limit the output by time or number of lines With netstat you won't get the username, if thats important to you. If you are using NT, check out Win32::EventLog (Process Win32 Event Logs) on CPAN and Usrstat.exe (Displays user name, full name, and last logon date and time) from the NT Server Resource Kit.