Home / Linux / Keeping track of Linux users: When do they log in and for how long?

Keeping track of Linux users: When do they log in and for how long?

The Linux command line provides some excellent tools for determining how frequently users log in and how much time they spend on a system. Pulling information from the /var/log/wtmp file that maintains details on user logins can be time-consuming, but with a couple easy commands, you can extract a lot of useful information on user logins.

One of the commands that helps with this is the last command. It provides a list of user logins that can go quite far back. The output looks like this:

$ last | head -5 | tr -s " "
shs pts/0 192.168.0.14 Wed Aug 14 09:44 still logged in
shs pts/0 192.168.0.14 Wed Aug 14 09:41 - 09:41 (00:00)
shs pts/0 192.168.0.14 Wed Aug 14 09:40 - 09:41 (00:00)
nemo pts/1 192.168.0.18 Wed Aug 14 09:38 still logged in
shs pts/0 192.168.0.14 Tue Aug 13 06:15 - 18:18 (00:24)

Note that the tr -s ” “ portion of the command above reduces strings of blanks to single blanks, and in this case, it keeps the output shown from being so wide that it would be wrapped around on this web page. Without the tr command, that output would look like this:

$ last | head -5
shs      pts/0        192.168.0.14     Wed Aug 14 09:44   still logged in
shs      pts/0        192.168.0.14     Wed Aug 14 09:41 - 09:41  (00:00)
shs      pts/0        192.168.0.14     Wed Aug 14 09:40 - 09:41  (00:00)
nemo     pts/1        192.168.0.18     Wed Aug 14 09:38   still logged in
shs      pts/0        192.168.0.14     Wed Aug 14 09:15 - 09:40  (00:24)

While it’s easy to generate and review login activity records like these for all users with the last command or for some particular user with a last username command, without the pipe to head, these commands will generally result in a lot of data. In this case, a listing for all users would have 908 lines.

$ last | wc -l
908

Counting logins with last

If you don’t need all of the login detail, you can view user login sessions as a simple count of logins for all users on the system with a command like this:

$ for user in `ls /home`; do echo -ne "$usert"; last $user | wc -l; done
dorothy 21
dory    13
eel     29
jadep   124
jdoe    27
jimp    42
nemo    9
shark   17
shs     423
test    2
waynek  201

The list above shows how many times each user has logged since the current /var/log/wtmp file was initiated. Notice, however, that the command to generate it does depend on user accounts being set up in the default /home directory.


>> Source Link

Loading...

Check Also

How to restore a forgone Google Chrome bookmark not export first

How to Restore Google Chrome Bookmarks – Google Chrome is a fairly popular web browser. …