interview question

sulekha · 11-12-2008, 10:24 AM

Hi all,

the following is the question which was asked in an interview

Give an example of a set of shell commands to tell how many times “bob” has logged on to the system this month ?

The answer i managed to google out was

Depends, checking secure.log depends on how often logrotate is running and how long it keeps things around.

Is there any other better answer ?

amani · 11-12-2008, 10:29 AM

grep the authentication log on most distros.

A better way is to base it on syslogd configuration

trickykid · 11-12-2008, 11:29 AM

On most systems, it's setup by default to log all users logins to wtmp and is rotated monthly by default in the logrotate.conf file:

Code:

/var/log/wtmp {
    monthly
    create 0664 root utmp
    rotate 1
}

You can use the last command to get the current month and by default it'll keep one month prior as you can see the rotate in the conf file as rotate 1. Change this to keep more months.

To get an accurate count of the current month, just do something like this:

Code:

last | grep username | wc -l

This would give you the amount of times username logged in.

To specify another wtmp file or previous month log, just pass something like this:

Code:

last -f /var/log/wtmp.1 | grep username | wc -l

That would be the correct answer givin what they actually asked. They wanted an example of commands used to get a number of logins, not checking sucure.log for how long they keep logs around, etc.

Hobbletoe · 11-12-2008, 12:00 PM

Using last and a bit of bash trickery ...

Code:

last | head -$(( $(last | wc -l) - $(last -t 20081101000000 | wc -l) | grep -w bob | wc -l

However, this would only work for the current month. If you would want it for a different month, this isn't much help, though it could be modified I suppose ...

Code:

a=$(last -t 20081001000000 | wc -l)
b=$(last -t 20081101000000 | wc -l)
last -$a | tail -$(( $a - $b )) | grep -w bob | wc -l

Which would give you the logins for October and not November. $a and $b could be modified to give you a varying array of dates. One month, two months, the past six months ... whatever. You could even use the date command to pull out the times that you want if it were scripted.

sulekha · 11-12-2008, 11:15 PM

Quote:

Originally Posted by trickykid

On most systems, it's setup by default to log all users logins to wtmp and is rotated monthly by default in the logrotate.conf file:

Code:

/var/log/wtmp {
    monthly
    create 0664 root utmp
    rotate 1
}

You can use the last command to get the current month and by default it'll keep one month prior as you can see the rotate in the conf file as rotate 1. Change this to keep more months.

To get an accurate count of the current month, just do something like this:

Code:

last | grep username | wc -l

This would give you the amount of times username logged in.

To specify another wtmp file or previous month log, just pass something like this:

Code:

last -f /var/log/wtmp.1 | grep username | wc -l

That would be the correct answer givin what they actually asked. They wanted an example of commands used to get a number of logins, not checking sucure.log for how long they keep logs around, etc.

I tried this

user@ubuntu:~$ last | grep username | wc -l
last: /var/log/wtmp: No such file or directory
Perhaps this file was removed by the operator to prevent logging last info.
0

NB:- I use ubuntu 8.04.1

trickykid · 11-13-2008, 09:33 AM

Quote:

Originally Posted by sulekha

NB:- I use ubuntu 8.04.1

I'm not an Ubuntu user so they might not use wtmp like most other distro's. Find the file that logs user logins and substitute it, might have to change a few things around.

But using the command last, it refers to the wtmp so you might just have to touch the file or create it before it starts logging to it.

But that would be the first response to the interviewer? Which distribution is this on? You can impress them by saying Ubuntu wouldn't use wtmp but RHEL/Fedora/CentOS and others use wtmp for login logs. But I'd imagine them being a business, they're probably using Red Hat or a clone of it that most likely will have wtmp.