cancel
Showing results for 
Search instead for 
Did you mean: 

Better last[b] command

Fedon Kadifeli
Super Advisor

Better last[b] command

The last and lastb commands as shipped in HP-UX have several inconveniences:

(1) The year is not displayed in the output.

(2) Only the logout "time" is displayed, not the "date" (you have to calculate it from the duration given in parentheses).

(3) It is not possible to select a portion of the output (let's say, I want only the information between December 1st 2008 - January 31st 2009).

Are there better versions of these commands, or has anybody written a program to display the data in /var/adm/*tmp* files in a more "script-friendly" way?
6 REPLIES
James R. Ferguson
Acclaimed Contributor

Re: Better last[b] command

Hi Fedon:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp|

...will convert the binary database into an ASCII stream which includes not only the year but the Epoch value of the human-readable date.

Regards!

...JRF...
Fedon Kadifeli
Super Advisor

Re: Better last[b] command

Thank you for the suggestion. Unfortunately, this command's output is 99% garbage:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp| tail
Jä 0 0 0000 0000 0 Jan 1 02:00:00 1970
0 0 0000 0000 0 Jan 1 02:00:00 1970 100.101.118.47
0 0 0000 45203 0 Jan 1 02:00:00 1970
dev/ 27403 8 0000 0000 0 Jan 1 02:00:00 1970
1886679855 13824 0000 0000 4879 Jan 1 03:21:19 1970 74.132.6.191
0 0 0000 32000 1886679855 Oct 14 16:44:15 2029
J
û 0 0 0000 0000 0 Jan 1 02:00:00 1970
0 0 0000 0000 0 Jan 1 02:00:00 1970 100.101.118.47
0 0 0000 45204 0 Jan 1 02:00:00 1970
dev/ 16163 8 0000 0000 0 Jan 1 02:00:00 1970
James R. Ferguson
Acclaimed Contributor

Re: Better last[b] command

Hi (again):

Sorry, try this:

# /usr/sbin/acct/fwtmp -X < /var/adm/wtmps|

You will have to filter the ASCII output based on the file layout.

Regards!

...JRF...
James R. Ferguson
Acclaimed Contributor

Re: Better last[b] command

Hi (again):

...and of course the command should look like:

# /usr/sbin/acct/fwtmp -X < /var/adm/wtmps

...I keep appending the trailing pipe :-(

Regards!

...JRF...
Fedon Kadifeli
Super Advisor

Re: Better last[b] command

Thank you.

This is better; but, with this command the logins and logouts are displayed on separate lines and it is difficult to correlate them.
James R. Ferguson
Acclaimed Contributor

Re: Better last[b] command

Hi (again) Fedon:

> This is better; but, with this command the logins and logouts are displayed on separate lines and it is difficult to correlate them.

Yes, that's true. However, if you look at the the record types I think you will see that with a little scripting you can filter what you need:

http://docs.hp.com/en/B2355-60130/utmp.4.html

Regards!

...JRF...