topic Re: Sorting the last command in Operating System - HP-UX

Sorting the last command

Nick D'Angelo — Tue, 28 Nov 2000 17:51:36 GMT

All,

I am looking for a way to sort the output of the last command. For example, the following script will give me a list of the last time a user has logged on, but I need it sorted by the oldest first and the latest logins last.

It lists one entry per user and the script is all on one line with no carriage returns.

awk -F: '{print "last | grep "$1" | head -1"}' /etc/passwd|ksh - > /home1/nickd/last.log

Appreciate the assistance, Nickd

Re: Sorting the last command

Rick Garland — Tue, 28 Nov 2000 17:57:33 GMT

Using the -r switch will sort in reverse order as well. This would be an additional switch to the sort

Re: Sorting the last command

Nick D'Angelo — Tue, 28 Nov 2000 18:03:49 GMT

I have used sort before, but not with dates.

The output looks like this:

smith ttyp4 Sat Nov 25 07:15 - 10:15 (03:15)

Sorting the Sat Nov 25 is the difficult part Rick.

Re: Sorting the last command

Dan Hetzel — Tue, 28 Nov 2000 18:23:17 GMT

Hi Nick,

sort won't help you in this case, at least not on the 'raw' data.
I think that you'll need a small shell script which will convert "Nov" into "11".

Even then, I guess that the dates are shown like they are with 'll', I mean that hour:min is used for dates less than 6 months while year is shown for older dates.

I wrote such a program quite a while ago, I just need to put my hands on.
I'll try to find it for you.

Maybe that using the date package in perl would be easier....

Dan

Re: Sorting the last command

Leslie Chaim — Tue, 28 Nov 2000 18:31:03 GMT

Try the -M option for sort. which will sort as month abbreviation:

Leslie

Re: Sorting the last command

Nick D'Angelo — Tue, 28 Nov 2000 18:45:13 GMT

Leslie,

I have tried sorting and the -M does not appear to sort the Month. Do you have specific examples?

Thanks,

Nickd

Re: Sorting the last command

James R. Ferguson — Tue, 28 Nov 2000 19:12:37 GMT

Nick:

Try this to order the output in ascending date sequence:

# last|sort -Mk4 -kn

...JRF...

Re: Sorting the last command

James R. Ferguson — Tue, 28 Nov 2000 19:13:12 GMT

Nick:

Try this to order the output in ascending date sequence:

# last|sort -Mk4 -kn5

...JRF...

Re: Sorting the last command

Rick Garland — Tue, 28 Nov 2000 19:31:45 GMT

Further parsing per your script:

last | awk '{if (($1 = "nickd")) print $0}' | sort -Mk4 -kn5

This is working for me. Give thanks to JRF for providing the sort syntax.

Re: Sorting the last command

James R. Ferguson — Tue, 28 Nov 2000 21:38:06 GMT

Nick:

...because I favor great precision, let me amend my post a bit to cause the output to be sorted in ascending login time within ascending login date. Thus:

# last|sort -Mk4 -kn5 -kn6.1,6.2 -kn6.4

...adding Rick's filter for your total solution:

# last|awk '{if (($1=="nickd")) print $0}'|sort -Mk4 -kn5 -kn6.1,6.2 -kn6.4

...JRF...

Re: Sorting the last command

Jordan Bean — Tue, 28 Nov 2000 23:10:42 GMT

Have you concidered using system accounting?

man 1m runacct
man 1m lastlogin

Have runacct run daily and monacct run monthly. You will find all last logins recorded to the day in

/var/adm/acct/sum/loginlog

in the format

YY-MM-DD username

This doesn't help you if you want more specific times during the day.

Re: Sorting the last command

Nick D'Angelo — Wed, 29 Nov 2000 13:06:53 GMT

Wow, Thanks for everyone's input.

One final step is required.

The command/script:

last | awk '{if (($1 = "nickd")) print $0}' | sort -Mk4 -kn5

Works, but only with one userid, mine. I am terrible at awk and I was looking for a complete list of everyone that was listed in /etc/passwd.

Thanks all.
Nick

Re: Sorting the last command

James R. Ferguson — Wed, 29 Nov 2000 13:33:56 GMT

Nick:

With regard to your last wish, try this as a quick and brutal solution:

/usr/bin/sh
IFS=:
while read USER NULL
do
last|awk -v USER=$USER '{if (($1==USER)) print $0}'|sort -Mk4 -kn5 -kn6.1,6.2
-kn6.4
done < /etc/passwd

...is this that which you seek?...regards!

...JRF...

Re: Sorting the last command

Nick D'Angelo — Wed, 29 Nov 2000 13:42:41 GMT

James,

Close big guy. This is the error that I get.

Let me ask you something that may help this. Can I have the output re-directed to a file first so that I can email it to myself automatically overnight when it runs?

The source line number is 1.
awk: Cannot find or open file -Mk4.
The source line number is 1.
awk: Cannot find or open file -Mk4.
The source line number is 1.

Thanks Nickd

Re: Sorting the last command

James R. Ferguson — Wed, 29 Nov 2000 14:28:23 GMT

Nick:

I should have just posted an attachment, so here it is with the addition of output redirection and automatic mailing to 'root'.

Regards!

...JRF...

Re: Sorting the last command

James R. Ferguson — Wed, 29 Nov 2000 14:38:00 GMT

Nick:

Oops! Use this version (attached). It adds redirection, mailing, and cleans up the previous log.

...JRF...

Re: Sorting the last command

James R. Ferguson — Wed, 29 Nov 2000 16:58:58 GMT

Nick:

Here's one "last" [pun intended] very much less brutal solution with better output for your specifications.

...JRF...

Re: Sorting the last command

Nick D'Angelo — Wed, 29 Nov 2000 19:39:04 GMT

James,

Thanks for your help thus far.

One more point, I only want each user recorded once in my log, their most recent login.

Therefore, when I look at my log, it will show me the following:

james Thu Apr 20 08:00 - 08:10
nickd Fri Nov 17 09:00 - 17:00

Your report is very thorough and detailed, but one level of detail too deep, if you know what I mean.

Sorry to drag this out.

Nickd

Re: Sorting the last command

James R. Ferguson — Wed, 29 Nov 2000 20:30:53 GMT

Nick:

OK, now you can have it both ways -- run with the '-v' option for verbose output; no flags give most recent only!

...JRF...

Re: Sorting the last command

Al Langen — Wed, 29 Nov 2000 23:50:26 GMT

I don't know what happens come January, 2001.
One thing you can do is to use the following to get your last output in reverse order is:

last | cat -n | sort -rn | cut -f 2

Apparently, what you want to know is the first time a user has logged in. I suggest that you take the script from James Ferguson and append the head -1 command to the end of the last $USER line.

One last thing: in unix, there many ways to do the same thing and you can do just about anything you except make a decent cup of coffee.