ok there is a problem, there is no check based on time.

I would need to check to see who was logged into the pts/# based on what time it was logged.

I know I can do it in perl, but would rather not.

if I have:

Jul 14 08:02:48 server1 su: - 0 user1-root
Jul 14 09:13:23 server1 su: + 0 user1-root
Jul 14 12:03:03 server1 su: + 0 user1-root
Jul 14 18:15:13 server1 su: + 0 user2-root
Jul 14 15:03:01 server1 su: + 0 user7-root


and


user1 pts/0 10.0.0.1 Thu Jul 14 08:00 - 10:00 (02:00)
user1 pts/0 10.0.0.2 Thu Jul 14 11:00 - 13:00 (02:00)
user2 pts/0 10.0.0.3 Wed Jul 14 16:00 - 20:00 (04:00)
user7 pts/0 hostx Wed Jul 14 13:25 - 15:01 (02:35)

I get:

Jul 14 08:02:48 server1 su: - 0 user1-root hostx
Jul 14 09:13:23 server1 su: + 0 user1-root hostx
Jul 14 12:03:03 server1 su: + 0 user1-root hostx
Jul 14 18:15:13 server1 su: + 0 user2-root hostx
Jul 14 15:03:01 server1 su: + 0 user7-root hostx