Display only logins with an inactivity period of 3 hours or more using who command
My problem is this:
I need to be able to display all logins that have been inactive for more than 3 hours using the who command. How can I accomplish this?
This is what I have so far:
Can someone help?
IMHO the easiest way to do time calculations is to convert time stamps to epoch first. Apart from caveats I don't want to think about like TZ, idle time > 24hrs, idle time > 'date --date="1 year ago";' which source it uses and what should happen on utmp/wtmp rotation/cleanup, time stamps don't show '%Y' and the date format is a human readable '%b %e %H:%M' one. So deal with strings like "old" in the idle time column, convert the start time and idle time to epoch and then check if idle time minus start time equals or is greater than three hours ago. Kludgy, not much fun but doable.
If you could use w command, it can give you better results too.
It shows JCPU & PCPU time based on process used by users. It can give you desired redults too.
But if you want to use who command.
use who -a. it gives you all information about logged in and logged out users.
if exit=0, it means users who are logged out.
You can find the list of logged in users who do not have exit=0
You can use last command for the list of logged in and logged out users.
Here you can find out the users who were logged in more than three hours but currently logged out.
But if you want to see details of logged in users, you can use
Suppose it is 20:00 pm and you want to know the users who were logged in around 18:00 pm and all after that, you can use
|All times are GMT -5. The time now is 06:34 PM.|