what function would tell me that a user has logged in or out?
i already know from my script the users name
i already know in real time there was an event
how an I tell if that event was a login or logout? Any ideas?
# i did try comparing the file sizes for change but various users may log in or out on a poll
# i did try to use 'comm -3 fileX' which outputs to the screen in different columns for login or logout but awk threw them both in column 1
Hey,
You could do a 'last <username>' to see the times they've logged in & out.
Do your users home directories contain a '.profile' file?
This file can be used to run scripts at login & logout on a per user basis, so you could create a script to dump information to a text file each time they login and then logout & also dump any commands that they run on your system.
I have also seen a script that will run until a certain user logs out, this can notify you by mail, wall etc.
mmm I'm not allowed to do that, can't touch anyone's files. I am monitoring movement and who is coming and going on a regular poll but detecting ins and outs is a bit prickly.
I've looked at the w, finger and who as well.
The timestamp seems the best option at this point, but I'll keep looking for now... thanks.
i suppose if someone disappears off the who list then they've logged out and if they appear they've logged in - in the simplest scenario.
implementing that may take a bit of thought (I'm a noob)
If you run the last command it will show all users comings and goings for the past month I think.
[root@gentest ~]#last
super pts/4 192.xxx.xxx.xxx Mon Aug 28 01:05 still logged in
super pts/4 192.xxx.xxx.xxx Sun Aug 27 11:26 - 01:05 (13:38)
super pts/4 192.xxx.xxx.xxx Sun Aug 27 01:36 - 11:26 (09:49)
super pts/4 192.xxx.xxx.xxx Sat Aug 26 11:37 - 23:53 (12:15)
super pts/4 192.xxx.xxx.xxx Sat Aug 26 01:23 - 11:37 (10:13)
user2 pts/5 192.xxx.xxx.xxx Fri Aug 25 20:58 - 20:59 (00:00)
super pts/4 192.xxx.xxx.xxx Fri Aug 25 16:39 - 01:23 (08:44)
user2 pts/4 192.xxx.xxx.xxx Fri Aug 25 16:00 - 16:39 (00:38)
user2 pts/4 192.xxx.xxx.xxx Thu Aug 24 22:55 - 22:56 (00:00)
user2 pts/5 192.xxx.xxx.xxx Wed Aug 23 21:42 - 22:48 (01:06)
user2 pts/4 192.xxx.xxx.xxx Wed Aug 23 21:15 - 22:48 (01:33)
user1 pts/2 Tue Aug 22 12:52 still logged in
user1 pts/1 Mon Aug 21 22:43 still logged in
yeh I looked at last too but it was hard to tell how many records to poll
last -n 20
I'm already grabbing the users off who so I guess if I could get a minutes seconds timestamp from there then it wouldn't affect my script until i call it off the file when i need it...
it seems the most logical.
i was just hoping there was a magic function which would tell me what they were doing lol... thanks again.
ps looks interesting too
If you want to see what users are doing in real-time
ps -ef | grep user
That has timestamp etc.
If your users are disconnecting with 'exit' or 'logout' you should see this also
ah you champion... thanks 