Usando last
e awk
last -R "$USER" | \
perl -ne 'print unless /wtmp\sbegins/ || /^$/' | \
awk 'END {print ,,}'
last
procura novamente pelo arquivo /var/log/wtmp
(ou o arquivo designado pelo -f
flag) e exibe uma lista de todos os usuários conectados (e fora) desde que esse arquivo foi criado.
Por padrão, /var/log/wtmp
é criado a cada novo mês:
% awk '/\/var\/log\/wtmp/,/}/' /etc/logrotate.conf
/var/log/wtmp {
missingok
monthly
create 0664 root utmp
rotate 1
}
last -R $USER
retorna todas as entradas de /var/log/wtmp
para o usuário especificado. O primeiro login é colocado na parte inferior da saída, portanto, o comando END
in my awk
.
% last -R "$USER"
aboettge pts/1 Wed Jul 15 12:04 still logged in
aboettge pts/1 Wed Jul 15 11:29 - 12:04 (00:34)
aboettge pts/1 Wed Jul 15 08:08 - 11:29 (03:21)
aboettge pts/1 Wed Jul 15 08:08 - 08:08 (00:00)
aboettge pts/1 Wed Jul 15 08:07 - 08:08 (00:00)
aboettge tty2 Wed Jul 15 08:03 still logged in
aboettge pts/1 Tue Jul 14 12:58 - down (00:53)
aboettge pts/1 Tue Jul 14 09:06 - 12:58 (03:51)
aboettge pts/1 Tue Jul 14 09:03 - 09:06 (00:02)
aboettge pts/1 Tue Jul 14 08:23 - 09:03 (00:40)
aboettge pts/1 Tue Jul 14 08:22 - 08:23 (00:00)
aboettge tty2 Tue Jul 14 08:22 - down (05:28)
aboettge pts/1 Mon Jul 13 12:01 - 16:26 (04:24)
aboettge pts/1 Mon Jul 13 11:49 - 11:59 (00:10)
aboettge pts/1 Mon Jul 13 11:46 - 11:49 (00:02)
aboettge tty2 Mon Jul 13 11:44 - down (04:42)
aboettge pts/2 Mon Jul 13 11:26 - 11:35 (00:08)
aboettge tty2 Mon Jul 13 11:25 - down (00:09)
aboettge pts/3 Fri Jul 10 14:26 - 14:28 (00:01)
aboettge pts/3 Fri Jul 10 14:23 - 14:26 (00:03)
aboettge pts/2 Fri Jul 10 13:34 - 15:27 (01:53)
aboettge pts/2 Fri Jul 10 13:31 - 13:31 (00:00)
aboettge pts/2 Fri Jul 10 13:25 - 13:30 (00:05)
aboettge pts/2 Fri Jul 10 10:28 - 13:19 (02:50)
aboettge pts/1 Fri Jul 10 08:35 - 15:27 (06:52)
aboettge tty2 Fri Jul 10 08:00 - down (07:28)
aboettge pts/1 Thu Jul 9 16:25 - 16:27 (00:01)
aboettge tty2 Thu Jul 9 16:21 - down (00:06)
aboettge tty1 Thu Jul 9 16:03 - crash (00:00)
aboettge tty1 Thu Jul 9 15:29 - 16:03 (00:33)
aboettge pts/1 Thu Jul 9 14:32 - 14:32 (00:00)
aboettge pts/1 Thu Jul 9 08:51 - 08:51 (00:00)
aboettge pts/1 Thu Jul 9 08:51 - 08:51 (00:00)
aboettge pts/1 Thu Jul 9 08:50 - 08:51 (00:00)
aboettge pts/1 Thu Jul 9 08:46 - 08:46 (00:00)
aboettge pts/1 Thu Jul 9 08:46 - 08:46 (00:00)
aboettge pts/1 Thu Jul 9 08:45 - 08:45 (00:00)
aboettge pts/1 Thu Jul 9 08:44 - 08:44 (00:00)
aboettge pts/1 Thu Jul 9 08:42 - 08:42 (00:00)
aboettge pts/1 Thu Jul 9 08:42 - 08:42 (00:00)
aboettge pts/1 Thu Jul 9 08:42 - 08:42 (00:00)
aboettge pts/1 Thu Jul 9 08:41 - 08:41 (00:00)
aboettge pts/1 Thu Jul 9 08:41 - 08:41 (00:00)
aboettge pts/1 Thu Jul 9 08:40 - 08:41 (00:00)
aboettge pts/1 Thu Jul 9 08:39 - 08:39 (00:00)
aboettge pts/1 Thu Jul 9 08:38 - 08:38 (00:00)
aboettge pts/1 Thu Jul 9 08:36 - 08:36 (00:00)
aboettge pts/1 Thu Jul 9 08:36 - 08:36 (00:00)
aboettge pts/1 Thu Jul 9 08:36 - 08:36 (00:00)
aboettge pts/1 Thu Jul 9 08:35 - 08:35 (00:00)
aboettge pts/1 Thu Jul 9 08:35 - 08:35 (00:00)
aboettge pts/2 Thu Jul 9 07:50 - 16:03 (08:12)
aboettge :0 Thu Jul 9 07:50 - crash (08:13)
aboettge pts/1 Wed Jul 8 16:13 - 16:27 (00:13)
aboettge pts/2 Wed Jul 8 13:47 - 16:27 (02:39)
aboettge pts/1 Wed Jul 8 11:30 - 14:14 (02:44)
aboettge pts/1 Wed Jul 8 08:18 - 11:29 (03:11)
aboettge :0 Wed Jul 8 08:02 - crash (23:47)
aboettge pts/2 Tue Jul 7 08:54 - 08:55 (00:00)
aboettge pts/1 Tue Jul 7 08:02 - 13:13 (05:10)
aboettge :0 Tue Jul 7 07:50 - down (05:23)
aboettge pts/1 Mon Jul 6 09:55 - 14:48 (04:53)
aboettge :0 Mon Jul 6 08:27 - crash (23:19)
aboettge pts/2 Fri Jul 3 07:52 - 15:30 (07:38)
aboettge :0 Fri Jul 3 07:51 - down (07:40)
aboettge pts/2 Thu Jul 2 15:16 - 15:18 (00:01)
aboettge pts/2 Thu Jul 2 15:07 - 15:07 (00:00)
aboettge pts/1 Thu Jul 2 14:46 - 16:21 (01:35)
aboettge pts/1 Thu Jul 2 09:53 - 09:53 (00:00)
aboettge pts/2 Thu Jul 2 08:00 - 14:41 (06:40)
aboettge :0 Thu Jul 2 08:00 - crash (23:47)
aboettge pts/5 Wed Jul 1 14:16 - 14:38 (00:21)
aboettge pts/3 Wed Jul 1 14:01 - 16:10 (02:09)
aboettge pts/2 Wed Jul 1 13:27 - 16:10 (02:42)
aboettge pts/1 Wed Jul 1 13:22 - 16:10 (02:48)
aboettge :0 Wed Jul 1 13:15 - 16:21 (03:05)
aboettge pts/2 Wed Jul 1 11:30 - 11:36 (00:06)
aboettge pts/1 Wed Jul 1 11:29 - 13:02 (01:32)
aboettge pts/1 Wed Jul 1 11:27 - 11:29 (00:01)
aboettge pts/2 Wed Jul 1 08:28 - 11:27 (02:58)
wtmp begins Wed Jul 1 08:28:18 2015
Exemplo
% last -R "$USER" | perl -ne 'print unless /wtmp\sbegins/ || /^$/' | awk 'END {print ,,}'
Jul 1 08:28
Discriminação
-
% last -R "$USER"
veja acima
-
perl -ne 'print unless /wtmp\sbegins/ || /^$/'
remove linhas vazias e
wtmp begins …
-
awk 'END {print ,,}'
imprime os campos 4, 5 e 6 da última linha, o separador padrão é
(um espaço)