I think a lot of that information may be stored in /var/log/wtmp. However, I'm not that familiar with parsing through wtmp to make any useful information. A script-based way to obtain information is by using the
last <username> commandl and then yank out the info you need. For instance, when I type in
last neil from the command prompt of one of my servers, I get this:
Code:
neil pts/198 h10-215-220-46. Tue Oct 19 15:15 - 16:56 (01:41)
neil pts/197 h10-215-220-46. Tue Oct 19 14:33 - 14:58 (00:24)
Username, terminal, hostname I connected from, Date/time when I connected through when I disconnected, and lastly my duration in (HH:MM) format.
