Sorting the last command

[Nick D'Angelo]

All,

I am looking for a way to sort the output of the last command. For example, the following script will give me a list of the last time a user has logged on, but I need it sorted by the oldest first and the latest logins last.

It lists one entry per user and the script is all on one line with no carriage returns.

awk -F: '{print "last | grep "$1" | head -1"}' /etc/passwd|ksh - > /home1/nickd/last.log

Appreciate the assistance, Nickd

[Rick Garland]

Using the -r switch will sort in reverse order as well. This would be an additional switch to the sort

[Nick D'Angelo]

I have used sort before, but not with dates.

The output looks like this:

smith ttyp4 Sat Nov 25 07:15 - 10:15 (03:15)

Sorting the Sat Nov 25 is the difficult part Rick.

[Dan Hetzel]

Hi Nick,

sort won't help you in this case, at least not on the 'raw' data.
I think that you'll need a small shell script which will convert "Nov" into "11".

Even then, I guess that the dates are shown like they are with 'll', I mean that hour:min is used for dates less than 6 months while year is shown for older dates.

I wrote such a program quite a while ago, I just need to put my hands on.
I'll try to find it for you.

Maybe that using the date package in perl would be easier....

Dan

[Leslie Chaim]

Try the -M option for sort. which will sort as month abbreviation:

Leslie

[Nick D'Angelo]

Leslie,

I have tried sorting and the -M does not appear to sort the Month. Do you have specific examples?

Thanks,

Nickd

[James R. Ferguson]

Nick:

Try this to order the output in ascending date sequence:

# last|sort -Mk4 -kn

...JRF...

[James R. Ferguson]

Nick:

Try this to order the output in ascending date sequence:

# last|sort -Mk4 -kn5

...JRF...

[Rick Garland]

Further parsing per your script:

last | awk '{if (($1 = "nickd")) print $0}' | sort -Mk4 -kn5

This is working for me. Give thanks to JRF for providing the sort syntax.

[James R. Ferguson]

Nick:

...because I favor great precision, let me amend my post a bit to cause the output to be sorted in ascending login time within ascending login date. Thus:

# last|sort -Mk4 -kn5 -kn6.1,6.2 -kn6.4

...adding Rick's filter for your total solution:

# last|awk '{if (($1=="nickd")) print $0}'|sort -Mk4 -kn5 -kn6.1,6.2 -kn6.4

...JRF...

[Jordan Bean]

Have you concidered using system accounting?

man 1m runacct
man 1m lastlogin

Have runacct run daily and monacct run monthly. You will find all last logins recorded to the day in

/var/adm/acct/sum/loginlog

in the format

YY-MM-DD username

This doesn't help you if you want more specific times during the day.

[Nick D'Angelo]

Wow, Thanks for everyone's input.

One final step is required.

The command/script:

last | awk '{if (($1 = "nickd")) print $0}' | sort -Mk4 -kn5

Works, but only with one userid, mine. I am terrible at awk and I was looking for a complete list of everyone that was listed in /etc/passwd.

Thanks all.
Nick

[James R. Ferguson]

Nick:

With regard to your last wish, try this as a quick and brutal solution:

/usr/bin/sh
IFS=:
while read USER NULL
do
last|awk -v USER=$USER '{if (($1==USER)) print $0}'|sort -Mk4 -kn5 -kn6.1,6.2
-kn6.4
done < /etc/passwd

...is this that which you seek?...regards!

...JRF...

[Nick D'Angelo]

James,

Close big guy. This is the error that I get.

Let me ask you something that may help this. Can I have the output re-directed to a file first so that I can email it to myself automatically overnight when it runs?

The source line number is 1.
awk: Cannot find or open file -Mk4.
The source line number is 1.
awk: Cannot find or open file -Mk4.
The source line number is 1.

Thanks Nickd

[James R. Ferguson]

Nick:

I should have just posted an attachment, so here it is with the addition of output redirection and automatic mailing to 'root'.

Regards!

...JRF...

[James R. Ferguson]

Nick:

Oops! Use this version (attached). It adds redirection, mailing, and cleans up the previous log.

...JRF...

[James R. Ferguson · Accepted solution]

Nick:

Here's one "last" [pun intended] very much less brutal solution with better output for your specifications.

...JRF...

[Nick D'Angelo]

James,

Thanks for your help thus far.

One more point, I only want each user recorded once in my log, their most recent login.

Therefore, when I look at my log, it will show me the following:

james Thu Apr 20 08:00 - 08:10
nickd Fri Nov 17 09:00 - 17:00

Your report is very thorough and detailed, but one level of detail too deep, if you know what I mean.

Sorry to drag this out.

Nickd

[James R. Ferguson]

Nick:

OK, now you can have it both ways -- run with the '-v' option for verbose output; no flags give most recent only!

...JRF...

[Al Langen]

I don't know what happens come January, 2001.
One thing you can do is to use the following to get your last output in reverse order is:

last | cat -n | sort -rn | cut -f 2

Apparently, what you want to know is the first time a user has logged in. I suggest that you take the script from James Ferguson and append the head -1 command to the end of the last $USER line.

One last thing: in unix, there many ways to do the same thing and you can do just about anything you except make a decent cup of coffee.

[Nick D'Angelo]

James,

Is it me, or does the latest procedure strictly go through the /etc/password file and list the last time each user login on?

I need one more sort, sorry to be a pain in the derriere, but sorted by last oldest date first and not by userid.

my email is Nickd63@yahoo.com if you need more details.

Thanks