LinuxQuestions.org - Display only logins with an inactivity period of 3 hours or more using who command

- Linux - General (https://www.linuxquestions.org/questions/linux-general-1/)

- - Display only logins with an inactivity period of 3 hours or more using who command (https://www.linuxquestions.org/questions/linux-general-1/display-only-logins-with-an-inactivity-period-of-3-hours-or-more-using-who-command-4175451289/)

Display only logins with an inactivity period of 3 hours or more using who command

My problem is this:

I need to be able to display all logins that have been inactive for more than 3 hours using the who command. How can I accomplish this?

This is what I have so far:

Code:

who -uH | grep -v 0: | pg

This results in a list similar to the one below:

Code:

root      vty1    May  9 10:50    old    14680242

someuser  pts/0  Feb 19 13:45    1:24    31916048  (userpc.domain.net)

someuser2  pts/1  Feb 15 14:43  17:43    45154356  (userpc2.domain.net)

someuser3  pts/11  Feb 20 15:09    .      22347826  (userpc3.domain.net)

someuser4  pts/25  Feb 20 07:42  16:58    30146784  (userpc4.domain.net)

someuser5  pts/34  Feb 22 07:50    .      20381822  (userpc5.domain.net)

With the above command, I see logins and activity under 1 minute; greater than 59 minutes. I only need to see inactivity of 3 hours or more.

Can someone help?

IMHO the easiest way to do time calculations is to convert time stamps to epoch first. Apart from caveats I don't want to think about like TZ, idle time > 24hrs, idle time > 'date --date="1 year ago";' which source it uses and what should happen on utmp/wtmp rotation/cleanup, time stamps don't show '%Y' and the date format is a human readable '%b %e %H:%M' one. So deal with strings like "old" in the idle time column, convert the start time and idle time to epoch and then check if idle time minus start time equals or is greater than three hours ago. Kludgy, not much fun but doable.

If you could use w command, it can give you better results too.
It shows JCPU & PCPU time based on process used by users. It can give you desired redults too.
But if you want to use who command.
use who -a. it gives you all information about logged in and logged out users.
if exit=0, it means users who are logged out.
You can find the list of logged in users who do not have exit=0

You can use last command for the list of logged in and logged out users.
Here you can find out the users who were logged in more than three hours but currently logged out.
But if you want to see details of logged in users, you can use

Code:

$ last | grep "Feb 27" | grep "still"

It will show the current logged in users of 27 feb with there logged in time.
Suppose it is 20:00 pm and you want to know the users who were logged in around 18:00 pm and all after that, you can use

Code:

last | grep "Feb 27" | grep "still" | grep -e "18:" -e "19:" -e "20:"

It will show you list of all users who were logged in after 18:00 pm and still logged in.