need to get last login info of each user

tahaz · 05-16-2012, 01:49 PM

hi

need to run a script which goes to multiple servers and get users last login info

NOTE: multiple servers = AIX,LINUX,SUNOS

i have created something but it turn out very dangerous

here is the script i wrote

Code:

#!/wh/bin/bash
for i in `./servers`
do
        LIST=`ssh $i cut -d: -f1 /etc/passwd`
        INFO=`ssh $i "last $LIST | head -1"`
        echo $INFO
done
exit

now this script instead of getting all the users from /etc/passwd and piping it with last command to show their last login info ... what it does is takes every user and runs it as a command and unlucky there is a user name halt (very bad) ... and it halted 15 of my servers

any help in this issue will be appreciated

Kustom42 · 05-16-2012, 02:17 PM

Put your code in the CODE tags please. Well to avoid getting the system users like halt do a grep on the passwd before you cut it for /bin/bash or you can do egrep with | separator if you have multiple shells. Then switch your last command to just do last and then grep for the user if you want to get fancy you can then sort on the date field and head the top one to get just the last login for that user.

Kustom42 · 05-16-2012, 02:18 PM

Also probably not a smart idea to post your -p option to the world showing your ssh port.

tahaz · 05-16-2012, 03:45 PM

thanks for the tip, on the port
well not understanding what u mean by grep for the user before cut passwd file
i need to get last login info of each human user from passwd file

Kustom42 · 05-16-2012, 04:24 PM

Code:

for i in `./servers`
do
LIST=$(ssh $i egrep "/bin/bash|/bin/ksh|/any/other/shells" /etc/passwd | cut -d: -f1 )
INFO=$(ssh $i last | grep $LIST)
echo $INFO
done
exit

tahaz · 05-16-2012, 05:33 PM

i got ur point now but was getting syntax error in ur script so i modified a bit but getting weird output

Quote:

more getusers
#!/wh/bin/bash
for i in `cat ./servers`
do
LIST=`ssh $i grep -v "false" /etc/passwd | cut -d: -f1`
INFO=`ssh $i last | grep $LIST`
echo $INFO
done
exit

OUTPUT>

sh getusers
grep: can't open user
grep: can't open user
grep: can't open user
grep: can't open user
grep: can't open user
grep: can't open user
grep: can't open user

NOTE: in the output im getting actual users

chrism01 · 05-16-2012, 06:29 PM

Try this

Code:

#!/wh/bin/bash
set -xv

Tinkster · 05-16-2012, 06:36 PM

I'm not sure I understand why you bother w/ parsing /etc/passwd ...
wouldn't something like this do the requested job?

Code:

  ssh $server "last" |tac|awk '$0 !~ /^[[:space:]]*$/ && $1 !~ /shutdown|reboot/ && $2 != "begins" {a[$1]=$0}END{for(i in a){print a[i]}}'

Cheers,
Tink

tahaz · 05-16-2012, 06:45 PM

Quote:

sh getusers
for i in `cat ./servers`

do
LIST=`ssh $i grep -v "false" /etc/passwd | cut -d: -f1`
INFO=`ssh $i last | grep $LIST`
echo $INFO
done
+ cat /blah/blah/servers
+ ssh <servername>+ grep cut -d: -f1
-v false /etc/passwd
LIST=root
user
user
user
user
so on
+ ssh + grep root user user user user user ... and so on
<servername> last
grep: can't open user
grep: can't open user
grep: can't open user
grep: can't open user
and so on ...
INFO=
+ echo

exit
+ exit

this is what i got as output

Tinkster · 05-16-2012, 09:00 PM

You probably didn't see my post because you were still typing while I saved
mine ... did you try the above? =o)

tahaz · 05-17-2012, 12:20 PM

@tink

i am not understanding what you have wrote
sorry i didnt try your command yesterday because i dont want to run any command without knowing what it does.
could you please explain it, i know im a noob

still

Kustom42 · 05-17-2012, 12:49 PM

Its a very intricate awk statement. I would stick to something simple for this task, no need to overkill it with awk.

Tinkster · 05-17-2012, 03:17 PM

Quote:

Originally Posted by Kustom42

Its a very intricate awk statement. I would stick to something simple for this task, no need to overkill it with awk.

Ummm ... conceptually what I'm doing there with awk is far simpler than the
two invocations of ssh & grepping & cutting ...

Code:

ssh $server "last" |

Same as yours, execute on each server ...

From here on it becomes different ... we handle all servers output locally,
just in case the implementations of tools differ on different platforms.

Code:

tac |

Reverse the output of last, so newest lines come out at the bottom
rather than at the top.

Code:

awk '$0 !~ /^[[:space:]]*$/ && $1 !~ /shutdown|reboot/ && $2 != "begins"

We tell awk to ignore lines that are EMPTY, contain shutdown or reboot in
the first field, or where the 2nd fiels is begins.

So all we get it lines w/ usernames ... and they come in chronological order.

We now create an array a, with the username being the index, and store the
entire line in the array. So on every run where the same user appears the
content of the array element that matches the users name gets overwritten
with the most recent login event.

Code:

{a[$1]=$0}

After the entire output of last has been processed we print all
array elements; in other words: all usernames with their last login date.

Code:

END{for(i in a){print a[i]}}'

Cheers,
Tink

Kustom42 · 05-17-2012, 04:13 PM

Great explanation tinkster, awk is one of those languages that is easy to read if you know it but looks like greek if you don't. I should use it more than I do but I very rarely write awk statements when I think about solving a problem.

You're solution will definitely get the job done and is probably a more stable way to go about it then the grep and cut statements. So tehaz I would go ahead and use tinksters statement as opposed to doing it with bash.

Tinkster · 05-17-2012, 05:43 PM

Quote:

Originally Posted by Kustom42

Great explanation tinkster, awk is one of those languages that is easy to read if you know it but looks like greek if you don't. I should use it more than I do but I very rarely write awk statements when I think about solving a problem.

You're solution will definitely get the job done and is probably a more stable way to go about it then the grep and cut statements. So tehaz I would go ahead and use tinksters statement as opposed to doing it with bash.

Thanks for the comment ... the "filters" may need to be amended depending on
the output of each platforms last, of course, and he still needs to
use a bash-wrapper to iterate over the server list.