topic Re: finding date in wtmp in Operating System - HP-UX

finding date in wtmp

Dalin Bruns — Thu, 26 Sep 2002 18:31:48 GMT

I want to search for a calculated date in a converted wtmp file, but am not able to get extra space in single digit dates in order to match the format in the converted wtmp.

e.g. excerpt from line in wtmp ... Jun 6
Note, the extra space between month and 6. When I calculate a date, I can't get the extra space in there. Please help.

Re: finding date in wtmp

James R. Ferguson — Thu, 26 Sep 2002 18:37:14 GMT

Hi:

How do you want to calculate the date and how do you want to search?

Regards!

...JRF...

Re: finding date in wtmp

Sridhar Bhaskarla — Thu, 26 Sep 2002 18:47:51 GMT

Hi,

Try this way

DAY=$(date +%d)
MONTH=$(date +%b)
DATE=$(printf "%s %2.3s" $MONTH $DAY)
last -R |grep "$DATE"

The above is only example. You can use that logic in your script.

-Sri

Re: finding date in wtmp

Dalin Bruns — Thu, 26 Sep 2002 18:49:06 GMT

interesting ... the extra space got taken out of my example.

Here's what I want to do. I want to keep the last 90 days of data in my wtmp, deleting the rest. I have calculated 90 days prior to today. My next step was going to be determining the line number matching my calc'd date and delete all previous lines. Something along these lines ...

X=grep -n "Jun 6" wtmp.tmp | head -1 | cut -d : -f 1

sed '1,Xd' wtmp.tmp > wtmp.clean

I know that isn't all correct, but I'm new to this scripting thing (coming from Win env) and I haven't worked out all the details. Any help would be greatly appreciated.

Re: finding date in wtmp

James R. Ferguson — Thu, 26 Sep 2002 19:03:07 GMT

Hi Dalin:

Your approach is fine. Do this:

X='Jun 6' #...there are really 2-blanks here...

# sed -e "1,/$X/"d filein

Regards!

...JRF...

Re: finding date in wtmp

Dalin Bruns — Thu, 26 Sep 2002 20:14:36 GMT

Thanks guys ... couldn't get Sri's to show extra space on my system after modifying date line to calculate back enough days to get in single digits, but it was a new approach ... James thanks for pointing out how to avoid all of that line number stuff. But, I still have the extra space issue.

I'm now thinking that I may have to awk out the month and day from the appropriate columns of the wtmp.tmp file and then match on both.

WDYT?

Re: finding date in wtmp

Sridhar Bhaskarla — Thu, 26 Sep 2002 20:22:27 GMT

Hi Dalin,

If you look at the value of $DATE, it will have two spaces for a single digit date and one space for double digit date from the month's field.

If you already calculated the date, it is easy to create an extra space between the month and the day using printf statement but you have to first devide the date into day and month as I did in the example.

-Sri

Re: finding date in wtmp

James R. Ferguson — Thu, 26 Sep 2002 20:26:05 GMT

Hi (again):

If you folllow Sri's use of 'printf' you can construct the "$X" argument to the 'sed' I suggested.

Regards!

...JRF...

Re: finding date in wtmp

Rodney Hills — Thu, 26 Sep 2002 20:27:51 GMT

Within ksh you can use typeset to force a variable to be two characters (with blank padding).

typeset -R2 daynum=6

Then when you use $daynum in your script it will have the extra space.

HTH

-- Rod Hills

Re: finding date in wtmp

Dalin Bruns — Fri, 27 Sep 2002 11:33:12 GMT

I tried again and it works!! Thanks for your suggestions. I am now well down the road to cleaning up my wtmp files.

Dalin