login audit bash script


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting login audit bash script
# 1  
Old 02-18-2012
login audit bash script

I am a bash beginner and I need to write an script to check my users login time. This has to be in a format of :

Quote:
Username : user.username
Start Date: Dec 4, 2011
End Date : Jan 11, 2012
Time On : 3hrs 12min
Host IP : 192.168.1.79
This script has to work on a server to check all the users. I know that I have to use "last" command but I have no idea how to do it.
any assistance is appreciated.
Thanks

# 2  
Old 02-18-2012
There's a script in this thread
https://www.unix.com/shell-programmin...-24-hours.html

That does something similar to what you seem to need. You'll have to modify the output to meet your needs, and drop the 'last day' limitation (should actually make it less complicated); at the least it should give you an idea about how to use the last command to do what you want.
# 3  
Old 02-18-2012
Great! Thanks very much

---------- Post updated at 01:47 PM ---------- Previous update was at 10:57 AM ----------

Well, apparently it doesn't work that way though. I need to get the files from /var/log with .bz2 extension and decompress them. this is where "last" command access and reads the wtmp file to get data when you use "finger" command.
The question is: without sudo or su permission how can I decompress thos bz2 files and put all of them together. because there are plenty of them in /var/log
Thanks.

Last edited by bashily; 02-18-2012 at 06:14 PM..
# 4  
Old 02-18-2012
Unless you have root privledges you cannot get this information. By design, a regular user cannot access this permission.
# 5  
Old 02-18-2012
Quote:
Originally Posted by bashily
Well, apparently it doesn't work that way though. I need to get the files from /var/log with .bz2 extension and decompress them. this is where "last" command access and reads the wtmp file to get data when you use "finger" command.
This question is: without sudo or su permission how can I decompress thos bz2 files and put all of them together. because there are plenty of them in /var/log
Thanks.
Really? Using last under linux, and the script below, I can generate exactly what you described in your original post. If you're running on FreeBSD, then the fields are organised differently, and last accepts different options, but the information is the same and can be parsed and presented without having to have root access.

Code:
#!/usr/bin/env ksh
last -Fa|awk '
    /wtmp begins/ { next; }
    /still logged in/ { next; }
    $0 == reboot { next; }

    NF > 0  {
        if( NR > 1 )
            printf( "\n" );

        printf( "       User:\t%s\n", $1 );     # user
        printf( "      Start:\t%s %s %s %s\n", $3, $4, $5, $6 );
        if( $9 == "down" )
            printf( "        End:\tshutdown\n" );
        else
            printf( "        End:\t%s %s %s %s\n", $9, $10, $11, $12 );

        if( substr( $NF, 1, 1 ) == "(" )
        {
            t = $NF;
            h = "localhost";
        }
        else
        {
            t = $(NF-1);
            h = $NF;
        }

        gsub( "[()]", "", t );
        printf( "    Time On:\t%s\n", t );
        printf( "Remote Host:\t%s\n", h );
} '

Sample output produced by the script:
Code:
       User:    scooter
      Start:    Tue Feb 14 22:33:16
        End:    Wed Feb 15 00:07:52
    Time On:    01:34
Remote Host:    localhost

       User:    scooter
      Start:    Sun Feb 12 12:52:49
        End:    Sun Feb 12 12:55:21
    Time On:    00:02
Remote Host:    liz


Last edited by agama; 02-18-2012 at 04:03 PM.. Reason: forgot to ignore reboot; added sample output
This User Gave Thanks to agama For This Post:
# 6  
Old 02-18-2012
I have 2 questions:
1- How did you learn bash scripting so well?
2- I have to look at the whole /var/log/wtmp files. There are so many of them and I have to add them to one file but I can't Smilie this is what I did:
Code:
# Check for existing /tmp/tst folder
if [ "/tmp/tst" != "" ]; then
rm -rf /tmp/tst
# Make a directory in /tmp called tst
mkdir -p /tmp/tst
# Copy wtmp files in /tmp/tst folder and unzip them:
cp -f /var/log/wtmp* /tmp/tst/
fi
bzip2 -d /tmp/tst/wtmp-*.bz2 | last -f wtmp-* > wtmpfile
cat wtmpfile

Then I have to add all the logged time of my users together and give a total as output. In your script you just used "last" command. which gives you only information from present machine not all other servers on the network.
correct me if I am wrong....
# 7  
Old 02-18-2012
Quote:
Originally Posted by bashily
I have 2 questions:
1- How did you learn bash scripting so well?
Lots of practice. I've been writing code for a very long time now, and still learn something with nearly every post.

Quote:
2- I have to look at the whole /var/log/wtmp files. There are so many of them and I have to add them to one file but I can't Smilie

...

Then I have to add all the logged time of my users together and give a total as output. In your script you just used "last" command. which gives you only information from present machine not all other servers on the network.
correct me if I am wrong....
I see. I didn't grock that you needed to produce output based on all of them, and not just from the most recent.

I think you are on the right track. You might find this a bit easier to manage:

Code:
#!/usr/bin/env ksh

cd /tmp                     # safe place to work
tfile=/tmp/wtmp.$$          # temp file to uncompress into
big_file=/tmp/$USER.wtmp    #collect all output from wtmp into one file

ls /var/tmp/wtmp*bz2 | while read file    # for each wtmp file
do
    bunzip2 -dc $file >$tfile   # uncompress writing output to tmp file
    last -F -a -f $tfile        # run last on it
done >$big_file                 # save all output from last in one file
last -F -a >>$big_file          # append formatted output from current wtmp
rm $tfile                       # tmp file not needed

### parse your big file (/tmp/$USER.wtmp) here #####

# cleanup before exit
rm $big_file

This unzips each bzipped wtmp file directly to a temporary file, and then immediately runs last on it collecting all of the output in one file. A final last is executed which uses the current wtmp file and appends that output to the big file. You can then parse the big file as needed. You won't need a temporary directory because you don't have to copy the files.

Hope this helps.

Last edited by agama; 02-18-2012 at 07:31 PM.. Reason: added some comments
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

How to block first bash script until second bash script script launches web server/site?

I'm new to utilities like socat and netcat and I'm not clear if they will do what I need. I have a "compileDeployStartWebServer.sh" script and a "StartBrowser.sh" script that are started by emacs/elisp at the same time in two different processes. I'm using Cygwin bash on Windows 10. My... (3 Replies)
Discussion started by: siegfried
3 Replies

2. Shell Programming and Scripting

Automate OTPW login to ssh via bash script

Hello everyone. I'm a Linux novice trying out a lot of bash scripting lately, as it is so very addictive. Lately I have been setting up one of my boxes remotely and have been hardening it as much as possible. Please allow me to explain the scenario, as it does tend to become a little... (1 Reply)
Discussion started by: instro
1 Replies

3. UNIX for Dummies Questions & Answers

Login PID in sh/bash different

In bourne shell the PID generated for the command "ps" matches my login id PID in the command "who -Hu" but in bash/linux the PID generated with the same commands are different . Why so? (2 Replies)
Discussion started by: asd78in
2 Replies

4. AIX

When AIX audit start, How to set the /audit/stream.out file size ?

Dear All When I start the AIX(6100-06)audit subsystem. the log will save in /audit/stream.out (or /audit/trail), but in default when /audit/stream.out to grow up to 150MB. It will replace the original /audit/stream.out (or /audit/trail). Then the /audit/stream.out become empty and... (2 Replies)
Discussion started by: nnnnnnine
2 Replies

5. Shell Programming and Scripting

Bash Login tester Script help!

Hello, first of all, I am a pretty experience c++ programmer, but have never really bothered learning bash scripting at all, so I know conceptually things that can be done in c++, but I'm not too sure about bash. I'm trying to learn Bash, and wanted to start out with a practical application. So I... (1 Reply)
Discussion started by: RSPdev
1 Replies

6. Shell Programming and Scripting

Help with Unix bash shell script login

Hi, I am a complete Unix novice and need some help with creating a login shell script. I have created a file with user details i.e. PIN, name etc and require help in recalling the specified details from the file and being prompted for a password on login. Any help would be very much appreciated.... (0 Replies)
Discussion started by: tdsrogers
0 Replies

7. Shell Programming and Scripting

BASH ssh login

Ok, there's been a good number of posts about this, but here goes. I want a script to log in to a system via ssh without using keys. This will be used to log in to Cisco IOS devices. I have tried the following, but could not get it to work: SSH login expect shell script to supply username and... (1 Reply)
Discussion started by: mike909
1 Replies

8. Shell Programming and Scripting

syntax error in audit script

Hi, When I run the following script #!/bin/sh email="rc@dll.com" subject="response times are more than a SECOND" rt=`tail audit.log | grep -i operationResponseTime | awk '{print $2}'` if then ### Mail the file to the mailbox mail -s $subject $email <<-end $rt ~.... (3 Replies)
Discussion started by: openspark
3 Replies

9. Shell Programming and Scripting

bash ssh login script

hello anyone have done ssh login script without "expect" (automatic login from host A / user b to Host B / user b without enter any passwords)? cheers (2 Replies)
Discussion started by: modcan
2 Replies

10. Shell Programming and Scripting

bash script for ssh login-

hi. I need a bash script which can login to an other mashin via SSH and then run some commands and then return the result to my mashine. I dont know where to begin, I think first I will need a ssh connection, dont know how to make it, then , do I need a ftp connection between the 2 mashins to... (5 Replies)
Discussion started by: big_pil
5 Replies
Login or Register to Ask a Question