andreas-h asked:
In my Debian Squeeze server, all user logins and logouts are recorded in the file /var/log/auth.log
Jan 28 07:11:06 xen8 sshd[29826]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 28 07:33:47 xen8 sshd[29826]: pam_unix(sshd:session): session closed for user root
Jan 28 09:45:58 xen8 sshd[14374]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 28 09:47:36 xen8 sshd[14374]: pam_unix(sshd:session): session closed for user root
Jan 29 07:37:48 xen8 sshd[24940]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 07:38:11 xen8 sshd[24940]: pam_unix(sshd:session): session closed for user root
Jan 29 08:35:13 xen8 sshd[25707]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 08:37:06 xen8 sshd[25707]: pam_unix(sshd:session): session closed for user root
Jan 29 16:59:39 xen8 sshd[30725]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 17:00:58 xen8 sshd[30725]: pam_unix(sshd:session): session closed for user root
Jan 29 17:11:17 xen8 sshd[30832]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 18:11:37 xen8 sshd[30832]: pam_unix(sshd:session): session closed for user root
Via the process id, one should be able to find matching logins/logouts, and then one could calculate the time. But my sed/awk skills are very limited, and maybe there’s even a ready-made script/tool for this task out there?
Is there an easy way to extract the times a user was logged in? Either in a total (per file), or maybe even with some nice graphics?
My answer:
Try the last command. This should show you all the information you’re looking for.
View the full question and any other answers on Server Fault.
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.