В UNIX, как найти пользователей, которые вошли в систему вчера или ранее

Ответ 1

last | fgrep "still logged in" | cut -d" " -f1 | uniq -u

Ответ 2

Вы можете сделать это программно, например.

В Python:

from pyutmp import UtmpFile
import time
import datetime

for utmp in UtmpFile():
    # utmp is a Utmp object
    if utmp.ut_user_process:
        duration=(time.time()-utmp.ut_time)
        if duration > (24*60*60):
            if not utmp.ut_user in users:
                    users.append(utmp.ut_user)
                    print '%s logged in at %s session duration: %d:%d:%d [%s] on tty %s from %s' % (utmp.ut_user, time.ctime(utmp.ut_time), (duration/3600), ((duration%3600)/60), (duration%60), datetime.timedelta(seconds=duration), utmp.ut_line, utmp.ut_host)

В Perl:

#! /usr/bin/perl -w

use lib './blib/lib', './blib/arch';
use Getopt::Std;
use User::Utmp qw(:constants);
use Socket;
use strict;

my @utmp;
my %ut_type = (BOOT_TIME()     => "BOOT_TIME",
           DEAD_PROCESS()  => "DEAD_PROCESS",
           EMPTY()         => "EMPTY",
           INIT_PROCESS()  => "INIT_PROCESS",
           LOGIN_PROCESS() => "LOGIN_PROCESS",
           NEW_TIME()      => "NEW_TIME",
           OLD_TIME()      => "OLD_TIME",
           RUN_LVL()       => "RUN_LVL",
           USER_PROCESS()  => "USER_PROCESS");
my ($user,$duration,$host,$hostAddr,$hostName,$start,$startX,$startXms,$line,$pid,%users);

   if (User::Utmp::HAS_UTMPX()) {
      @utmp = User::Utmp::getutx();
   } else {
      @utmp = User::Utmp::getut();
   }

  print "\nActive Users - loged in for more than a day\n";

  foreach my $entry (@utmp)
  {
     unless ($entry->{"ut_type"} != USER_PROCESS || $users{$entry->{"ut_user"}} ) {
        $user           = $entry->{"ut_user"};
        $host           = $entry->{"ut_host"};
        $hostAddr       = $entry->{"ut_addr"};
        $start          = $entry->{"ut_time"};
        $startX         = $entry->{"ut_tv"};
        $startXms       = $entry->{tv_usec};
        $line           = $entry->{"ut_line"};
        $pid            = $entry->{"ut_pid"};
        $duration       = time - $start;

        next if ($duration < (24*60*60));
        $users{$user} = $user;

        if ($hostAddr) {
          $hostName     = gethostbyaddr($hostAddr, AF_INET) ;
          $hostName .= " (" ;
          $hostName .= join(".", unpack("C4", $hostAddr));
          $hostName .= ")";
        } else {
          $hostName="";
        }

         printf "User: %s, has been logged in since: %s, duration %d:%d:%d [%d days %d hours %d mins %d secs], on %s (PID: %s), from %s [%s]\n", $user, scalar(localtime($start)), $duration/3600, ($duration%3600)/60, $duration%60, ($duration/(3600*24)), $duration/3600, ($duration%3600)/60, $duration%60, $line, $pid, $host, $hostName;
     }
  }
  print "\n\n";