Making wtmp files readable one at a time

Stryfe16 · February 17, 2012, 9:23am

New Unix user/scripter here. Been trying to solve a problem for two days now with no luck. Hoping someone here has an answer.

Essentially I have a list of wtmp files which I have decompressed and copied to a temporary directory. Using the following command I can turn them into a file than can normally be read with the cat command:

last -f wtmpfile > wtmpfilecopy

The problem is that I need to do this to all the files while retaining the beginning of the original file name. So it doesn't matter if anything is added to the end of the file name as long at the original file name is the beginning of the copies name. This will be going into a script. I've been experimenting with for loops as I found some information that looked promising but still have not found success.

I hope this is enough information and I hope someone out there knows a solution.

Thanks in advance!

methyl · February 17, 2012, 10:16am

What Operating System and version you you have and what Shell do you use?

What are you trying to achieve? What final output are you looking for?

What are the names of the various wtmp files? Are they all in the same directory (including the active wtmp file itself)?
Have you been able to preserve the timestamp on each wtmp file?

There is rarely ever a need to expand a whole wtmp file into text.

Ps. I regularly run a script to find the last time a named user logged in. This script looks at a long history of wtmp files in reverse chronological order.

Stryfe16 · February 17, 2012, 12:24pm

I'm using OpenSuse (school computer) and using BASH. What I'm trying to achieve is that I am eventually going to have to grep each of the files looking for a particular string. The string will only be matched in one of the files. The names of the wtmp files are wtmp-######### where #s are a timestamp and I need to preserve that time stamp once I turn the files into readable ones. Thus far, yes I have been able to preserve the timestamp. It comes down to being able to grep each of the wtmp files individually for a specific string to find the file so I know which file contains the record I'm looking for.

methyl · February 17, 2012, 1:05pm

I guess you mean something like this:

cd /directory
ls -1t wtmp-* 2>/dev/null | while read filename
do
        last -f "${filename}" > "${filename}".txt
        grep -l "string" "${filename}".txt | while read found
        do
                 echo "found ${string} in ${filename}"
                 grep "${string}" "${filename}"
        done
done

Stryfe16 · February 17, 2012, 10:18pm

methyl:

I guess you mean something like this:

cd /directory
ls -1t wtmp-* 2>/dev/null | while read filename
do
   last -f "${filename}" > "${filename}".txt
   grep -l "string" "${filename}".txt | while read found
   do
   echo "found ${string} in ${filename}"
   grep "${string}" "${filename}"
   done
done

Thank you kindly for the try but it didn't work. There's no way to simply change the wtmp files into readable files? If I can get them readable I can move on from that point. I just need to have them cat-able basically. If not, I'm thinking I may simply have to try another approach to this problem. Again thank you very much for the feedback.