how can i view the amount of times each user has connected to my system

flea89 · 03-11-2010, 09:45 AM

Hi
I am connected to a network via SHH. Now, i know how i can see
which users are logged on as well, but how can i see how many times
each user has connected? this refering to users that have logged on
at least once... thank you

jwl17330536 · 03-11-2010, 09:49 AM

cat /var/log/auth.log | grep "Accepted" | grep "<username>" | wc

Keep in mind that will only count the amount since the log has been rolled over.. I don't know of a way to know how many since the server was deployed.

jamescondron · 03-11-2010, 09:50 AM

Well, take a look at last, lastb and lastlog. You may have to script a solution instead, which would require working with /var/log/wtmp and /var/log/btmp

I don't know of any specific way, you see

flea89 · 03-11-2010, 09:54 AM

thank you very much for the immediate answers...

@jamescondron: i also thought scripting the solution is the best way to go...

as for working with /var/log/wtmp and /var/log/btmp could you explain to me what these do?

anyway thank you both i am a COMPLETE newbie to Linux so my questions
may sound quite stupid

jamescondron · 03-11-2010, 09:58 AM

Well, certain important files have man pages too, and wtmp is the same. It is basically a binary file containing the information last uses. btmp; lastb.

Using wtmp and btmp will require something a bit more than scripting know-how, so you may find it easier to parse the output from last, lastb and lastlog.

But yes, take a look at the man pages

Code:

man <command>

and you should get a better idea, certainly a better one than I can give you

flea89 · 03-11-2010, 10:06 AM

thanks again. i am already looking at man pages for all the commands you
refered to and it is helpful, however my problem remains on how i will
count the times each user has logged on to get an result like:

[<myusername>@di o g eni s ~ ] $ countlogins . sh
48 theodor pc4236 . c e id . upatras . gr
48 theodo pc4236 . c e id . upatras . gr
42 voulgari82. 1 6 9 . 1 0 . 2 9

. . .

where countlogins.sh is my bash script and i.e. theodor is a user that
has connected 48 times on diogenis......

so if there are any ideas about that, bring them on

otherwise, i thank u very much for your help already and hopefully
i'll find it

jamescondron · 03-11-2010, 10:12 AM

Well, assume your output looks as thus:

Code:

jc@jcmain:~$ last -f /var/log/wtmp.1 -200
jc       pts/7        192.168.1.8      Sun Feb 28 15:48 - 15:51  (00:02)
jc       pts/0        :0.0             Fri Feb 26 23:26   still logged in
jc       tty7         :0               Fri Feb 26 23:25   still logged in
reboot   system boot  2.6.30-custom    Fri Feb 26 23:25 - 16:07 (12+16:41)
jc       pts/11       :0.0             Thu Feb 25 13:36 - crash (1+09:49)
jc       tty2                          Mon Feb 22 17:37 - crash (4+05:47)
jc       tty2                          Mon Feb 22 17:37 - 17:37  (00:00)
jc       pts/8        :0.0             Mon Feb 22 15:02 - 15:02  (00:00)
jc       pts/0        :0.0             Mon Feb 22 14:54 - crash (4+08:30)
jc       pts/0        :0.0             Mon Feb 22 14:54 - 14:54  (00:00)
jc       tty7         :0               Mon Feb 22 14:53 - crash (4+08:31)
reboot   system boot  2.6.30-custom    Mon Feb 22 14:53 - 16:07 (17+01:13)
jc       pts/0        :0.0             Sat Feb 20 23:52 - down  (1+14:58)
jc       tty7         :0               Sat Feb 20 23:52 - down  (1+14:59)
reboot   system boot  2.6.30-custom    Sat Feb 20 23:51 - 14:51 (1+14:59)
jc       tty2                          Wed Feb 17 19:58 - down  (3+03:51)
jc       tty2                          Wed Feb 17 19:58 - 19:58  (00:00)
jc       pts/0        :0.0             Sat Feb 13 08:46 - down  (7+15:03)
jc       tty7         :0               Sat Feb 13 08:45 - down  (7+15:04)
reboot   system boot  2.6.30-custom    Sat Feb 13 08:44 - 23:49 (7+15:04)
jc       pts/11       :0.0             Thu Feb 11 21:27 - down  (1+01:53)
jc       pts/11       :0.0             Wed Feb 10 20:15 - 20:20  (00:04)
jc       pts/10       :0.0             Tue Feb  9 19:25 - 19:25  (00:00)
jc       pts/10       :0.0             Mon Feb  8 19:25 - 19:26  (00:00)
jc       pts/10       :0.0             Mon Feb  8 18:41 - 18:41  (00:00)
jc       pts/10       :0.0             Mon Feb  8 18:32 - 18:32  (00:00)
jc       pts/0        :0.0             Mon Feb  8 09:44 - down  (4+13:36)
jc       tty7         :0               Mon Feb  8 09:43 - down  (4+13:36)
reboot   system boot  2.6.30-custom    Mon Feb  8 09:43 - 23:20 (4+13:37)
security pts/6        :1.0             Sun Feb  7 22:21 - down   (11:16)
security tty2                          Sun Feb  7 22:20 - down   (11:17)
security tty2                          Sun Feb  7 22:20 - 22:20  (00:00)
jc       pts/0        :0.0             Sun Feb  7 13:58 - down   (19:39)
jc       tty7         :0               Sun Feb  7 13:58 - down   (19:39)
reboot   system boot  2.6.30-custom    Sun Feb  7 13:53 - 09:37  (19:44)
jc       pts/0        :0.0             Sun Feb  7 10:36 - crash  (03:17)
jc       tty7         :0               Sun Feb  7 10:36 - crash  (03:17)
reboot   system boot  2.6.30-custom    Sun Feb  7 10:35 - 09:37  (23:02)
jc       pts/0        :0.0             Sun Feb  7 01:03 - crash  (09:32)
jc       tty7         :0               Sun Feb  7 01:02 - crash  (09:32)
reboot   system boot  2.6.30-custom    Sun Feb  7 01:02 - 09:37 (1+08:35)
jc       pts/0        :0.0             Sun Feb  7 00:52 - crash  (00:09)
jc       tty7         :0               Sun Feb  7 00:52 - crash  (00:10)
reboot   system boot  2.6.30-custom    Sun Feb  7 00:51 - 09:37 (1+08:46)
jc       pts/0        :0.0             Sat Feb  6 21:00 - crash  (03:50)
jc       tty7         :0               Sat Feb  6 21:00 - crash  (03:51)
reboot   system boot  2.6.30-custom    Sat Feb  6 21:00 - 09:37 (1+12:37)
jc       pts/0        :0.0             Sat Feb  6 13:42 - crash  (07:17)
jc       tty7         :0               Sat Feb  6 13:41 - crash  (07:18)
reboot   system boot  2.6.30-custom    Sat Feb  6 13:41 - 09:37 (1+19:56)
jc       pts/0        :0.0             Sat Feb  6 12:31 - crash  (01:10)
jc       tty7         :0               Sat Feb  6 12:30 - crash  (01:10)
reboot   system boot  2.6.30-custom    Sat Feb  6 12:30 - 09:37 (1+21:07)
jc       pts/13       :0.0             Wed Feb  3 18:38 - 19:02  (00:24)
security pts/14       :1.0             Tue Feb  2 17:50 - down  (3+18:15)
security pts/12       :1.0             Tue Feb  2 13:15 - down  (3+22:50)
security pts/7        :1.0             Tue Feb  2 12:12 - down  (3+23:53)
security pts/7        :1.0             Tue Feb  2 11:41 - 12:12  (00:31)
jc       tty3                          Tue Feb  2 11:24 - down  (4+00:41)
jc       tty3                          Tue Feb  2 11:24 - 11:24  (00:00)
security pts/7        :1.0             Tue Feb  2 11:23 - 11:41  (00:17)
security tty2                          Tue Feb  2 11:19 - down  (4+00:46)
security tty2                          Tue Feb  2 11:19 - 11:19  (00:00)
jc       pts/0        :0.0             Tue Feb  2 09:47 - down  (4+02:18)
jc       tty7         :0               Tue Feb  2 09:46 - down  (4+02:19)
reboot   system boot  2.6.30-custom    Tue Feb  2 09:46 - 12:06 (4+02:19)
jc       pts/12       192.168.1.8      Mon Feb  1 20:33 - 20:33  (00:00)
jc       pts/12       192.168.1.8      Mon Feb  1 20:33 - 20:33  (00:00)
jc       pts/12       192.168.1.8      Mon Feb  1 20:32 - 20:33  (00:00)
root     pts/12       192.168.1.8      Mon Feb  1 18:01 - 18:03  (00:02)
security pts/12       192.168.1.8      Mon Feb  1 16:51 - 16:58  (00:06)
security pts/12       192.168.1.8      Mon Feb  1 16:37 - 16:39  (00:02)
security pts/11       :1.0             Mon Feb  1 16:14 - down   (17:28)
security tty2                          Mon Feb  1 16:08 - down   (17:34)
security tty2                          Mon Feb  1 16:08 - 16:08  (00:00)

wtmp.1 begins Mon Feb  1 16:08:28 2010

(wtmp.1 is my log from last month)

All we do then is count each instance of a particular username. You can get the individual ones any number of ways, you could make an array of usernames from /etc/passwd, you could just go line by line, if in array then array[user] ++, else array.append(user) etc.

It kinda depends on what you want to write your script in, really

flea89 · 03-13-2010, 10:52 AM

considering what you said

and also with some awk research i ended up with:$ awk '{count[$1]++}END{for(j in count) print j,"("count[j]" logons)"}' FS=: users.txt

where users.txt is a list of users that logged on lately...

i have only one FINAL question: i want to print my final list in descending order. in the above command, where would the sort desc be put to have that result?