Problems in analysing SSH LOG users & time


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting Problems in analysing SSH LOG users & time
# 1  
Old 04-25-2014
Problems in analysing SSH LOG users & time

Attached is the log file that I have generated through the following script:
Code:
last | head -2 |sed '2q;d' |awk '{ print $1"\t"$2"\t"$3"\t\t"$4"\t"$5"\t"$6"\t"$7"\t"$8"\t" $9"\t"$10"\t"$11}'>>/var/log/logadmin/logtest.txt




But now I'm unable to run the following operations on it:
1. Count number of distinct users logged in & display their name and IP
2. Count number of users logged in at a particular time & display their name (How to take the input of time)
3. Count number of users logged in between a particular time by taking input of the time intervals.


As I want to give input of Time Intervals by myself and then count and display the users logged at that time. I'am having difficulties in doing so.

Here is the log generated:
Code:
swapnil	 pts/0	 :0	 Thu	Apr	21	18:05	-	18:05	(00:00)	 swapnil	 pts/0	 :0	 Sat	Apr	21	18:07	-	18:08	(00:01)	
cc2	 pts/2	 swapnil-inspiron	 Mon	Apr	21	18:18	-	18:18	(00:00)	
cc2	 pts/2	 swapnil-inspiron	 Mon	Apr	21	18:23	-	18:23	(00:00)	
cc5	 pts/2	 swapnil-inspiron	 Mon	Apr	21	18:26	-	18:26	(00:00)	
cc6	 pts/2	 172.27.23.46	 Mon	Apr	21	18:28	-	18:30	(00:02)	
cc1	 pts/3	 swapnil-inspiron	 Mon	Apr	21	18:29	-	18:45	(00:16)
cc8	 pts/4	 172.27.23.49	 Mon	Apr	21	18:30	-	18:37	(00:07)
cc4	 pts/5	 swapnil-inspiron	 Mon	Apr	21	18:30	-	18:30	(00:00)	
cc2	 pts/4	 172.27.23.49	 Mon	Apr	21	18:30	-	18:41	(00:11)
cc8	 pts/5	 swapnil-inspiron	 Mon	Apr	21	18:31	-	18:32	(00:01)	
cc1	 pts/6	 swapnil-inspiron	 Mon	Apr	21	18:31	-	18:32	(00:00)	
cc4	 pts/5	 swapnil-inspiron	 Mon	Apr	21	18:32	-	18:40	(00:0
cc6	 pts/2	 swapnil-inspiron	 Mon	Apr	21	18:32	-	18:33	(00:00)	
cc3	 pts/2	 172.27.23.49	 Mon	Apr	21	18:33	-	18:36	(00:03)
cc4	 pts/3	 swapnil-inspiron	 Mon	Apr	21	18:33	-	18:37	(00:04)
cc8	 pts/9	 swapnil-inspiron	 Mon	Apr	21	18:34	-	18:34	(00:00)	
cc1	 pts/4	 swapnil-inspiron	 Mon	Apr	21	18:35	-	18:35	(00:00)	
cc4	 pts/2	 172.27.23.119	 Mon	Apr	21	18:36	-	18:40	(00:04)
cc6	 pts/3	 172.27.23.131	 Mon	Apr	21	18:42	-	18:42	(00:00)	
cc4	 pts/3	 172.27.23.131	 Mon	Apr	21	18:42	-	18:43	(00:01)	
cc7	 pts/3	 172.27.23.116	 Mon	Apr	21	18:43	-	18:43	(00:00)	
cc1	 pts/3	 172.27.23.116	 Mon	Apr	21	18:43	-	18:43	(00:00)	
cc8	 pts/3	 172.27.23.116	 Mon	Apr	21	18:43	-	18:43	(00:00)	
swapnil	 pts/3	 172.27.23.116	 Mon	Apr	21	18:44	-	18:51	(00:07)	
swapnil	 pts/3	 172.27.23.116	 Mon	Apr	21	18:44	-	18:47	(00:03)
cc3	 pts/4	 172.27.23.131	 Mon	Apr	21	18:44	-	18:47	(00:03)
cc7	 pts/5	 172.27.23.246	 Mon	Apr	21	18:45	-	18:46	(00:00)	
cc5	 pts/3	 172.27.23.123	 Mon	Apr	21	18:46	-	18:52	(00:06)
swapnil	 pts/4	 172.27.23.125	 Mon	Apr	21	18:47	-	18:48	(00:01)
cc5	 pts/5	 172.27.23.19	 Mon	Apr	21	18:49	-	18:51	(00:02)
swapnil	 pts/0	 :0	 Mon	Apr	21	19:05	-	19:05	(00:00)	
swapnil	 pts/0	 :0	 Mon	Apr	22	11:28	-	11:28	(00:00)	
cc2	 pts/4	 172.27.23.49	 Tue	Apr	22	11:30	-	11:41	(00:11)
cc8	 pts/5	 swapnil-inspiron	 Tue	Apr	22	11:40	-	11:41	(00:01)	
cc1	 pts/6	 swapnil-inspiron	 Tue	Apr	22	11:45	-	11:50	(00:05)	
cc4	 pts/5	 swapnil-inspiron	 Tue	Apr	22	11:51	-	11:52	(00:01)	
cc2	 pts/4	 172.27.23.49	 Wed	Apr	23	12:01	-	12:05	(00:04)
cc8	 pts/5	 swapnil-inspiron	 Wed	Apr	23	17:34	-	17:36	(00:02)	
cc1	 pts/6	 swapnil-inspiron	 Wed	Apr	23	17:37	-	17:42	(00:05)	
cc2	 pts/5	 swapnil-inspiron	 Wed	Apr	23	17:45	-	17:46	(00:01)
cc6	 pts/3	 172.27.23.131	 Wed	Apr	23	17:50	-	17:55	(00:05)
swapnil	 pts/4	 172.27.23.125	 Thu	Apr	24	01:00	-	01:09	(00:03)	
cc4	 pts/3	 172.27.23.131	 Thu	Apr	24	01:02	-	01:05	(00:03)	
cc7	 pts/3	 172.27.23.116	 Thu	Apr	24	01:03	-	01:03	(00:00)	
swapnil	 pts/4	 172.27.23.125	 Thu	Apr	24	01:05	-	01:08	(00:03)
cc5	 pts/5	 172.27.23.19	 Wed	Apr	24	01:09	-	01:10	(00:01)
cc6	 pts/3	 172.27.23.131	 Wed	Apr	24	13:42	-	13:42	(00:00)	
cc4	 pts/3	 172.27.23.131	 Wed	Apr	24	13:42	-	13:43	(00:01)	
cc7	 pts/3	 172.27.23.116	 Wed	Apr	24	13:43	-	13:43	(00:00)	
cc1	 pts/3	 172.27.23.116	 Wed	Apr	24	13:43	-	13:43	(00:00)	
cc8	 pts/3	 172.27.23.116	 Wed	Apr	24	13:43	-	13:43	(00:00)	
swapnil	 pts/3	 172.27.23.116	 Wed	Apr	24	13:44	-	13:47	(00:03)
cc3	 pts/4	 172.27.23.131	 Wed	Apr	24	13:44	-	13:47	(00:03)
cc7	 pts/5	 172.27.23.246	 Wed	Apr	24	13:45	-	13:46	(00:00)	
cc5	 pts/3	 172.27.23.123	 Wed	Apr	24	13:46	-	13:47	(00:01)
swapnil	 pts/3	 172.27.23.116	 Wed	Apr	24	13:44	-	13:47	(00:03)
cc3	 pts/4	 172.27.23.131	 Wed	Apr	24	13:44	-	13:47	(00:03)
cc7	 pts/5	 172.27.23.246	 Wed	Apr	24	13:45	-	13:46	(00:00)	
cc5	 pts/3	 172.27.23.123	 Wed	Apr	24	13:46	-	13:55	(00:09)
swapnil	 pts/0	 :0	 Thu	Apr	25	19:05	-	19:05	(00:00)	
swapnil	 pts/0	 :0	 Sat	Apr	26	04:07	-	04:08	(00:00)	
swapnil	 pts/0	 :0	 Sat	Apr	26	04:08	-	04:08	(00:00)


Last edited by Don Cragun; 04-26-2014 at 01:48 AM.. Reason: Fix tags.
# 2  
Old 04-28-2014
You did not mention your operating system and shell, so I am assuming Linux and bash here. Please note that under different OS and/or shell, you may need to tweak the commands a little:
#1)
Code:
gacanepa@debian $ cat logtest.txt | sort -uk1,1 | cut -f1,3
cc1     swapnil-inspiron
cc2     swapnil-inspiron
cc3     172.27.23.49
cc4     swapnil-inspiron
cc5     swapnil-inspiron
cc6     172.27.23.46
cc7     172.27.23.116
cc8     172.27.23.49
swapnil     :0
gacanepa@debian $ cat logtest.txt | sort -uk1,1 | cut -f1,3 | wc -l
9
gacanepa@debian $

As to #2, when you say "particular time" do you mean a fixed date and time, like Apr 21 18:46?
Assuming that you want to filter by month and day, you can do something like this:
Code:
gacanepa@debian $ cat logtest.txt | awk '/Apr/ && /24/'
cc7     pts/5     172.27.23.246        Mon    Apr    21    18:45    -    18:46    (00:00)     
swapnil     pts/4     172.27.23.125        Thu    Apr    24    01:00    -    01:09    (00:03)     
cc4     pts/3     172.27.23.131        Thu    Apr    24    01:02    -    01:05    (00:03)     
cc7     pts/3     172.27.23.116        Thu    Apr    24    01:03    -    01:03    (00:00)     
swapnil     pts/4     172.27.23.125        Thu    Apr    24    01:05    -    01:08    (00:03)
cc5     pts/5     172.27.23.19        Wed    Apr    24    01:09    -    01:10    (00:01)
cc6     pts/3     172.27.23.131        Wed    Apr    24    13:42    -    13:42    (00:00)     
cc4     pts/3     172.27.23.131        Wed    Apr    24    13:42    -    13:43    (00:01)     
cc7     pts/3     172.27.23.116        Wed    Apr    24    13:43    -    13:43    (00:00)     
cc1     pts/3     172.27.23.116        Wed    Apr    24    13:43    -    13:43    (00:00)     
cc8     pts/3     172.27.23.116        Wed    Apr    24    13:43    -    13:43    (00:00)     
swapnil     pts/3     172.27.23.116        Wed    Apr    24    13:44    -    13:47    (00:03)
cc3     pts/4     172.27.23.131        Wed    Apr    24    13:44    -    13:47    (00:03)
cc7     pts/5     172.27.23.246        Wed    Apr    24    13:45    -    13:46    (00:00)     
cc5     pts/3     172.27.23.123        Wed    Apr    24    13:46    -    13:47    (00:01)
swapnil     pts/3     172.27.23.116        Wed    Apr    24    13:44    -    13:47    (00:03)
cc3     pts/4     172.27.23.131        Wed    Apr    24    13:44    -    13:47    (00:03)
cc7     pts/5     172.27.23.246        Wed    Apr    24    13:45    -    13:46    (00:00)     
cc5     pts/3     172.27.23.123        Wed    Apr    24    13:46    -    13:55    (00:09)
gacanepa@debian $ cat logtest.txt | awk '/Apr/ && /24/' | wc -l
19
gacanepa@debian $

Hope you find this useful. Let us know if you need further help with #3.
Best regards.
Login or Register to Ask a Question

Previous Thread | Next Thread

9 More Discussions You Might Find Interesting

1. Homework & Coursework Questions

Sort current logged in users by log in time (supposedly to be very easy but I'm missing something)

1. The problem statement, all variables and given/known data: Show all users who are currently logged in, sorted from earliest to latest log in time. The log in time includes the month, day, and time. 2. Relevant commands, code, scripts, algorithms: finger, who, sort, pipe, head, tail, ... (8 Replies)
Discussion started by: vtmd
8 Replies

2. Shell Programming and Scripting

Specified log in time for users

I have this task : Check the logintime.txt every minute to only allow user to log in at the specified time. logintime.txt has the following content: USER TIME_START TIME_STOP Example: john 17:00 18:00 My idea is locking the user at the TIME_STOP and unlocking at the TIME_START while... (4 Replies)
Discussion started by: muffle
4 Replies

3. Shell Programming and Scripting

Monitoring a users log in time?

how do i start with this guys? Sample run: $ LOGTIME it2015678 <enter> User it2015678 is CRUZ Tommy H And has logged on to the system for: 8 hours 12 minutes from the time this script was run. (1 Reply)
Discussion started by: skypigeon
1 Replies

4. Shell Programming and Scripting

How to list Commands used by users & with time stamp

hi, Do anybody know, how to list out all the commands & scripts used by the user & root along with the timestamps under ksh & csh shells. Thanks in advance Regards BS (1 Reply)
Discussion started by: raghunsi
1 Replies

5. UNIX for Dummies Questions & Answers

Analysing Log Files?

I'm not sure if this query is relevant to this forum but here goes anyways... I want analyse log files that do not appear to be of standard format. I have tried using Analog but cannot config it to read the files. Does anyone have any advice on working with log files taken from a Unix... (6 Replies)
Discussion started by: Sepia
6 Replies

6. UNIX for Dummies Questions & Answers

Help analysing progress of a log file

Is it possible to track the progress of a job (informatica) by analysing the progress of it's log file ? I have a long running job, and no way of tracking how far allong it is. Thanks. (4 Replies)
Discussion started by: cosmos328is
4 Replies

7. UNIX for Advanced & Expert Users

Analysing truss log

I am facing the following issue when using db2. The JDBC prepared statement command is sending an incorrect value to the database for search. I did a truss on the app and here is the log. I want to know what is the value that is getting passed. is it possible. 26867/68: send(62,... (2 Replies)
Discussion started by: buytamil
2 Replies

8. Solaris

OS Problems -no DNS & SSH not working

I just installed Solaris 6/10 without any problems but I didn't connect the network cable when I installed it. Here are my problems: -I can access webpages using IP addrsses but not with domain names -ssh is installed but it is not running ('ps -e | grep sshd' didn't show it) I have been... (4 Replies)
Discussion started by: kungpow
4 Replies

9. UNIX for Dummies Questions & Answers

log users real time

hi.... how i can configurator a log file on real time....on unix solaris.... thanks a lot.... Best Regards... (3 Replies)
Discussion started by: chanfle
3 Replies
Login or Register to Ask a Question