logout information

[Jeganathan Venkitasamy]

Hi,

Is there any way to find list of users "log-out" on any given day?

It is easy to find list of users "log-in" on any given day by using 'last' command.

But logout details....?

Thanks in advance...

Regards,
Jegi,
NBC

[Sachin Patel]

Hi
You can compare who and last's output and find out who log-out.

Sachin

[George_14]

Last command will show you both logged in and loggout details(user-id, terminal, m/c name /ip address Day Month,date,loggedin time, logged out time, total logged in time). See the below out put of last command.
user1 pts/1 128.1.20.25 Fri Jul 20 10:55 - 17:13 (06:18)
user1 pts/1 128.1.20.25 Fri Jul 20 10:52 - 10:55 (00:02)
user1 pts/1 128.1.20.25 Fri Jul 20 10:02 - 10:27 (00:25)
user1 pts/1 128.1.20.25 Fri Jul 20 08:58 - 09:01 (00:02)
user1 pts/1 128.1.20.25 Mon Jul 16 08:20 - 17:49 (09:29)

[Jeganathan Venkitasamy]

Okay friends,

I think I need to refine my question.

To find logins on say July 12th, I need to run

# last|grep "Jul 12"
( this command may need to be fine tuned to get correct result )

The output will show list of logins on July 12th. This is how we can find "list of users logged in on any given day".

My question is 'how to find list of users logged out on July 12th ?'

Last command output has logout details but not the date of logout.

My intention is to find "list of users or at least number of users logged out on any given day"

I think I made my intention clear.

Thanks guys,
Jegi

[MANOJ SRIVASTAVA]

Hi Jeganathan

try this

last | awk ' { if ( $4=="Jul" && $5=="6") print $NF,$4,$5,$6,$7,$8 } ' > filename

Manoj Srivastava

[Jeganathan Venkitasamy]

Hi manoj,

Thanks for your response. Anyhow, your command will give me details of logins and logout if the user logout on same day( in our case July 12th). But what if the user logged in at 11:00PM on July 11th and logout on July 12th 4:00AM. If the user name is 'test', then this login session record will show in last command as

"test pts/0 3.3.15.90 Wed Jul 11 23:00 - 04:00 (05:00)"

Though this test user logged out on July 12th, last command doesn't keep date stamp for logout.
I wonder is there any command or method to find logout date.

We have a system with approximately 1000 users and a typical users login session may range from 10 minutes to 10 days. We are conducting a study of system utilization over a range of past 6 months. That's how I got this weird requirement of "finding list of users logged out on any given day"!

Eagerly waiting for some clue.

Thanks & regards,
Jegi

[Sachin Patel]

Hi Jeganathan
When ever someone logs in you will have a entry created in wtmp file so for example I login today and I am not loged out my entry looks like this
sachin ttyp1 Tue Jul 24 13:32 still logged in
Then I log-out my entry looks like this
#{sachin}% last | grep Jul | grep 24
sachin ttyp1 Tue Jul 24 13:32 - 13:34 (00:01)
sachin ttyp1 Tue Jul 24 13:30 - 13:30 (00:00)
So That means I login and out two time today in this system.
#last |grep
I have test this in my system as I type.

Sachin

[Darrell Allen · Accepted solution]

Hi Jegi,

You might use "who -a /var/adm/wtmp" and grep or awk the stuff you need. Here's sample entry lines for the login and logout of a session:

userx pts/trc Jul 24 14:35 0:01 27783 sysA

userx pts/trc Jul 24 14:37 0:01 27783 id= trc term=0 exit=0

Use the loginid and tty fields to match the logout with the login. Good luck,

Darrell

[Mladen Despic]

Hi Jegi,

The output of 'last' contains the date and time of each login, and also, the length of the login session in hours and minutes. Now you could write a small program that takes the time and date of the login, adds the number of hours and minutes of the session, and calculates the date for the moment the session was ended.

I have seen some related questions on this forum where people wanted to know how to calculate the date so many days before or after today. If you think you could make use of this, try search for "calculate date" on the Forum. (You will likely find a lot of good suggestions.)

HTH

Mladen

[Jeganathan Venkitasamy]

Thanks a lot friends!

Darrell's solution is smart. The only thing I need to do to find logouts on say July 12th is

#who -a /var/adm/wtmp|grep "Jul 12"|grep "exit=0"

It really works!

Mladen's approach will also lead me to get desired result. I thought of it already.But that calls for a real complicated scripting.

Thanks a lot friends.

Thanks & regards,
Jegi