3

In my Debian Squeeze server, all user logins and logouts are recorded in the file /var/log/auth.log

Jan 28 07:11:06 xen8 sshd[29826]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 28 07:33:47 xen8 sshd[29826]: pam_unix(sshd:session): session closed for user root
Jan 28 09:45:58 xen8 sshd[14374]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 28 09:47:36 xen8 sshd[14374]: pam_unix(sshd:session): session closed for user root
Jan 29 07:37:48 xen8 sshd[24940]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 07:38:11 xen8 sshd[24940]: pam_unix(sshd:session): session closed for user root
Jan 29 08:35:13 xen8 sshd[25707]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 08:37:06 xen8 sshd[25707]: pam_unix(sshd:session): session closed for user root
Jan 29 16:59:39 xen8 sshd[30725]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 17:00:58 xen8 sshd[30725]: pam_unix(sshd:session): session closed for user root
Jan 29 17:11:17 xen8 sshd[30832]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 18:11:37 xen8 sshd[30832]: pam_unix(sshd:session): session closed for user root

Via the process id, one should be able to find matching logins/logouts, and then one could calculate the time. But my sed/awk skills are very limited, and maybe there's even a ready-made script/tool for this task out there? Is there an easy way to extract the times a user was logged in? Either in a total (per file), or maybe even with some nice graphics?

fuero
  • 9,413
  • 1
  • 35
  • 40
andreas-h
  • 1,054
  • 1
  • 16
  • 27

3 Answers3

7

The ac utility will provide you with statistics on the user login. For instance, to see the total number of secs/minutes/hours a user named user1 was on the system -

  ac -d user1

output 

 Jan 22  total        4.19
 Jan 23  total        8.01
 Jan 24  total        7.84
 Jan 25  total        6.79
 Jan 28  total        7.37
 Jan 29  total        8.69
 Today   total        7.15
Daniel t.
  • 9,061
  • 1
  • 32
  • 36
  • 2
    Maybe it's good to know that ac is provided by `psacct` package, because it's not part of the base. – golja Jan 30 '13 at 22:33
5

Try the last command. This should show you all the information you're looking for.

Michael Hampton
  • 237,123
  • 42
  • 477
  • 940
4

The final column of the output of the last command will show what you want 

iain     pts/0        host          Mon Jan 28 22:44 - 23:12  (00:27)
user9517
  • 114,104
  • 20
  • 206
  • 289