User last successful login

[Ngoh Chean Siung]

Hi,

Is there any way or script to get all the users last successful login & pipe to a text file?

Example the data captured is:
peter|24Oct2004
andrew|16Oct2004

regards.

[Michael Schulte zur Sur]

Hi,

just use > after the command you used to get the data captured.
Your question is a bit vague.
You can use cut or awk with field separator | to single out fields.

greetings,

Michael

[G. Vrijhoeven]

Hi,

You could use the last command.

e.g.

for i in $(cat /etc/passwd | awk -F: '( $3 > 100 ) { print $1 } ')
do
last -1 $i | awk '{ print $1"|"$5,$4 }'
done

Regards,

Gideon

[Franky_1]

Hi,

you can use the "last" command which gives you your desired output

only last will give you the successful logins of all users

if you use last it'll give you the info only for that named user
You can customize the output using awk

eg

last |awk '{print $1,$4,$5,$6}'

lastb would be the contrary (unsuccessful logins) btw

Regards

Franky

[Fred Ruffet]

As long as I think your main problem is to get all logins, you can use the "last" command as root. It will give you all logins for all users.

Parsing it with perl like this :
$ll="";
open(STDIN,"last|sort -k 1|");
while () {
chomp;
$cl=$_;
($user,@rest)=split / */,$cl;
($luser,@rest)=split / */,$ll;
if ($user eq $luser) {
$ll=$cl;
} else {
print "$ll\n";
$ll=$cl;
}
}
print "$cl\n";

will give you last line for each user. Modify it to get the output you want.

Regards,

Fred

[Ngoh Chean Siung]

Hi,

What I want is to get the LATEST last login for each users. Example andrew has login to server in July and Aug, then the script will only retrieve a line of user id & the month is Aug. (No duplicated)

Any idea?

regards.

[Fred Ruffet]

... That's exactly what my script did...

Regards,

Fred

[G. Vrijhoeven]

Hi,

last -1 username

check my previouse post, may be it has some errors but it does a grep on user stings in the passwd file, ( only users >100 as uid) and issue a last -1 on that user. Redirection to a file .. done >>file


Regards,

Gideon

[Ngoh Chean Siung]

Hi,

Gideon
Your script is running but how to sort by alphabetical and display the year login? Beside that, why there is only "|" appears?

Output:
ehg|18 Oct
hamdanar|26 Oct
lkf|26 Oct
ckkhoo|26 Oct
leg|26 Oct
|
wtmp|8 Oct
|
wtmp|8 Oct
hcwong|26 Oct
|
wtmp|8 Oct
vasus|23 Sep
|


Fred
There is some errors when I am running your script.

Error:
# sh user.sh
user.sh: =: not found.
user.sh[2]: Syntax error at line 2 : `(' is not expected.

regards

[G. Vrijhoeven]

Hi,

In order to sort, use the sort command
...
done | sort >>file

Why the only the "|" appears.. this can be the case when the user never logged in.
you can solv this by
..
done | grep -v ^| sort >>file

Regards,

Gideon

[Ngoh Chean Siung]

Hi,

It prompts me this error when I added the line that you proposed

# sh user.sh
grep: illegal option -- ^
usage: grep [-E|-F] [-c|-l|-q] [-bhinsvx] -e pattern_list...[-f pattern_file...] [file...]

usage: grep [-E|-F] [-c|-l|-q] [-bhinsvx] [-e pattern_list...]-f pattern_file...[file...]

usage: grep [-E|-F] [-c|-l|-q] [-bhinsvx] pattern [file...]

Btw, is it able to show the year login as well?

regards.

[G. Vrijhoeven]

Sorrie,

done | grep -v "^|" | sort >> file

As far as i know last does not print a year.

HTH,

Gideon

[Fred Ruffet]

Errors on my script... maybe because it is a perl script. Not a shell one :)

Regards,

Fred

[Hein van den Heuvel]

'one liner' in perl:

last | perl -e 'while(<>){($u,$x,$x,$m,$d)=split; $all{$u}="$m $d" unless ($all{$u})} foreach (sort keys %all) {print "$_|$all{$_}\n" if ($_)}'

- loop through input
- split by whitespace, remembering user, month, day
- remember date for user unless that user has a day already
- when all input processed, report on all remembered users, sorted.

no, I do not knwo how a year change looks like. But a perl script like above is readily expanded to have a rolling months window where every month in this year prints the current year, and every 'future' month prints the last year.

Hein

[Muthukumar_5]

We can collect all normal users ( except system users) with listusers so that,

for user in `listusers | awk '{ print $1 }'`
do
last -1 $user | awk '{ print $1"|"$5$4 }'
done

We can not get year informations from last output there.

HTH.

[Muthukumar_5]

To get current year and more efficient manner then use as,

# for user in `logins -u | awk '{ print $1 }'`
do
last -1 $user | grep -v '^wtmp begins' | awk '{ printf $1"|"$5$4;system("date +'%Y'") }'
done

Some user will not contain login details. That will show as wtmp begin.. information with log there.

HTH.

[Hein van den Heuvel · Accepted solution]

I needed a coffee break.. below a potential solution with year handling. It compares todays month and day ($M, $D) with the one in the last record ($m, $d) and adjust the year if deemed in the past.


test.p:
($x,$x,$x,$D,$M,$Y)=localtime;
while(<>){
($u,$x,$x,$m,$d)=split;
next if ($all{$u});
$y = $Y + 1900;
$i = index("JanFebMarAprMayJunJulAugSepOctNovDec",$m)/3;
next if ($i < 0);
$y-- if ($i > $M);
$y-- if ($i == $M && $d > $D);
$all{$u}="|$m $d $y";
}
foreach (sort keys %all) {
print "$_$all{$_}\n" if ($_);
}

Usage:

last | perl test.p


Cheers,
Hein.