Problems in analysing SSH LOG users & time

Lionking93 · April 25, 2014, 8:20pm

Attached is the log file that I have generated through the following script:

last | head -2 |sed '2q;d' |awk '{ print $1"\t"$2"\t"$3"\t\t"$4"\t"$5"\t"$6"\t"$7"\t"$8"\t" $9"\t"$10"\t"$11}'>>/var/log/logadmin/logtest.txt

But now I'm unable to run the following operations on it:

Count number of distinct users logged in & display their name and IP
Count number of users logged in at a particular time & display their name (How to take the input of time)
Count number of users logged in between a particular time by taking input of the time intervals.

As I want to give input of Time Intervals by myself and then count and display the users logged at that time. I'am having difficulties in doing so.

Here is the log generated:

swapnil	 pts/0	 :0	 Thu	Apr	21	18:05	-	18:05	(00:00)	 swapnil	 pts/0	 :0	 Sat	Apr	21	18:07	-	18:08	(00:01)	
cc2	 pts/2	 swapnil-inspiron	 Mon	Apr	21	18:18	-	18:18	(00:00)	
cc2	 pts/2	 swapnil-inspiron	 Mon	Apr	21	18:23	-	18:23	(00:00)	
cc5	 pts/2	 swapnil-inspiron	 Mon	Apr	21	18:26	-	18:26	(00:00)	
cc6	 pts/2	 172.27.23.46	 Mon	Apr	21	18:28	-	18:30	(00:02)	
cc1	 pts/3	 swapnil-inspiron	 Mon	Apr	21	18:29	-	18:45	(00:16)
cc8	 pts/4	 172.27.23.49	 Mon	Apr	21	18:30	-	18:37	(00:07)
cc4	 pts/5	 swapnil-inspiron	 Mon	Apr	21	18:30	-	18:30	(00:00)	
cc2	 pts/4	 172.27.23.49	 Mon	Apr	21	18:30	-	18:41	(00:11)
cc8	 pts/5	 swapnil-inspiron	 Mon	Apr	21	18:31	-	18:32	(00:01)	
cc1	 pts/6	 swapnil-inspiron	 Mon	Apr	21	18:31	-	18:32	(00:00)	
cc4	 pts/5	 swapnil-inspiron	 Mon	Apr	21	18:32	-	18:40	(00:0
cc6	 pts/2	 swapnil-inspiron	 Mon	Apr	21	18:32	-	18:33	(00:00)	
cc3	 pts/2	 172.27.23.49	 Mon	Apr	21	18:33	-	18:36	(00:03)
cc4	 pts/3	 swapnil-inspiron	 Mon	Apr	21	18:33	-	18:37	(00:04)
cc8	 pts/9	 swapnil-inspiron	 Mon	Apr	21	18:34	-	18:34	(00:00)	
cc1	 pts/4	 swapnil-inspiron	 Mon	Apr	21	18:35	-	18:35	(00:00)	
cc4	 pts/2	 172.27.23.119	 Mon	Apr	21	18:36	-	18:40	(00:04)
cc6	 pts/3	 172.27.23.131	 Mon	Apr	21	18:42	-	18:42	(00:00)	
cc4	 pts/3	 172.27.23.131	 Mon	Apr	21	18:42	-	18:43	(00:01)	
cc7	 pts/3	 172.27.23.116	 Mon	Apr	21	18:43	-	18:43	(00:00)	
cc1	 pts/3	 172.27.23.116	 Mon	Apr	21	18:43	-	18:43	(00:00)	
cc8	 pts/3	 172.27.23.116	 Mon	Apr	21	18:43	-	18:43	(00:00)	
swapnil	 pts/3	 172.27.23.116	 Mon	Apr	21	18:44	-	18:51	(00:07)	
swapnil	 pts/3	 172.27.23.116	 Mon	Apr	21	18:44	-	18:47	(00:03)
cc3	 pts/4	 172.27.23.131	 Mon	Apr	21	18:44	-	18:47	(00:03)
cc7	 pts/5	 172.27.23.246	 Mon	Apr	21	18:45	-	18:46	(00:00)	
cc5	 pts/3	 172.27.23.123	 Mon	Apr	21	18:46	-	18:52	(00:06)
swapnil	 pts/4	 172.27.23.125	 Mon	Apr	21	18:47	-	18:48	(00:01)
cc5	 pts/5	 172.27.23.19	 Mon	Apr	21	18:49	-	18:51	(00:02)
swapnil	 pts/0	 :0	 Mon	Apr	21	19:05	-	19:05	(00:00)	
swapnil	 pts/0	 :0	 Mon	Apr	22	11:28	-	11:28	(00:00)	
cc2	 pts/4	 172.27.23.49	 Tue	Apr	22	11:30	-	11:41	(00:11)
cc8	 pts/5	 swapnil-inspiron	 Tue	Apr	22	11:40	-	11:41	(00:01)	
cc1	 pts/6	 swapnil-inspiron	 Tue	Apr	22	11:45	-	11:50	(00:05)	
cc4	 pts/5	 swapnil-inspiron	 Tue	Apr	22	11:51	-	11:52	(00:01)	
cc2	 pts/4	 172.27.23.49	 Wed	Apr	23	12:01	-	12:05	(00:04)
cc8	 pts/5	 swapnil-inspiron	 Wed	Apr	23	17:34	-	17:36	(00:02)	
cc1	 pts/6	 swapnil-inspiron	 Wed	Apr	23	17:37	-	17:42	(00:05)	
cc2	 pts/5	 swapnil-inspiron	 Wed	Apr	23	17:45	-	17:46	(00:01)
cc6	 pts/3	 172.27.23.131	 Wed	Apr	23	17:50	-	17:55	(00:05)
swapnil	 pts/4	 172.27.23.125	 Thu	Apr	24	01:00	-	01:09	(00:03)	
cc4	 pts/3	 172.27.23.131	 Thu	Apr	24	01:02	-	01:05	(00:03)	
cc7	 pts/3	 172.27.23.116	 Thu	Apr	24	01:03	-	01:03	(00:00)	
swapnil	 pts/4	 172.27.23.125	 Thu	Apr	24	01:05	-	01:08	(00:03)
cc5	 pts/5	 172.27.23.19	 Wed	Apr	24	01:09	-	01:10	(00:01)
cc6	 pts/3	 172.27.23.131	 Wed	Apr	24	13:42	-	13:42	(00:00)	
cc4	 pts/3	 172.27.23.131	 Wed	Apr	24	13:42	-	13:43	(00:01)	
cc7	 pts/3	 172.27.23.116	 Wed	Apr	24	13:43	-	13:43	(00:00)	
cc1	 pts/3	 172.27.23.116	 Wed	Apr	24	13:43	-	13:43	(00:00)	
cc8	 pts/3	 172.27.23.116	 Wed	Apr	24	13:43	-	13:43	(00:00)	
swapnil	 pts/3	 172.27.23.116	 Wed	Apr	24	13:44	-	13:47	(00:03)
cc3	 pts/4	 172.27.23.131	 Wed	Apr	24	13:44	-	13:47	(00:03)
cc7	 pts/5	 172.27.23.246	 Wed	Apr	24	13:45	-	13:46	(00:00)	
cc5	 pts/3	 172.27.23.123	 Wed	Apr	24	13:46	-	13:47	(00:01)
swapnil	 pts/3	 172.27.23.116	 Wed	Apr	24	13:44	-	13:47	(00:03)
cc3	 pts/4	 172.27.23.131	 Wed	Apr	24	13:44	-	13:47	(00:03)
cc7	 pts/5	 172.27.23.246	 Wed	Apr	24	13:45	-	13:46	(00:00)	
cc5	 pts/3	 172.27.23.123	 Wed	Apr	24	13:46	-	13:55	(00:09)
swapnil	 pts/0	 :0	 Thu	Apr	25	19:05	-	19:05	(00:00)	
swapnil	 pts/0	 :0	 Sat	Apr	26	04:07	-	04:08	(00:00)	
swapnil	 pts/0	 :0	 Sat	Apr	26	04:08	-	04:08	(00:00)

gacanepa · April 27, 2014, 11:02pm

You did not mention your operating system and shell, so I am assuming Linux and bash here. Please note that under different OS and/or shell, you may need to tweak the commands a little:
#1)

gacanepa@debian $ cat logtest.txt | sort -uk1,1 | cut -f1,3
cc1     swapnil-inspiron
cc2     swapnil-inspiron
cc3     172.27.23.49
cc4     swapnil-inspiron
cc5     swapnil-inspiron
cc6     172.27.23.46
cc7     172.27.23.116
cc8     172.27.23.49
swapnil     :0
gacanepa@debian $ cat logtest.txt | sort -uk1,1 | cut -f1,3 | wc -l
9
gacanepa@debian $

As to #2, when you say "particular time" do you mean a fixed date and time, like Apr 21 18:46 ?
Assuming that you want to filter by month and day, you can do something like this:

gacanepa@debian $ cat logtest.txt | awk '/Apr/ && /24/'
cc7     pts/5     172.27.23.246        Mon    Apr    21    18:45    -    18:46    (00:00)     
swapnil     pts/4     172.27.23.125        Thu    Apr    24    01:00    -    01:09    (00:03)     
cc4     pts/3     172.27.23.131        Thu    Apr    24    01:02    -    01:05    (00:03)     
cc7     pts/3     172.27.23.116        Thu    Apr    24    01:03    -    01:03    (00:00)     
swapnil     pts/4     172.27.23.125        Thu    Apr    24    01:05    -    01:08    (00:03)
cc5     pts/5     172.27.23.19        Wed    Apr    24    01:09    -    01:10    (00:01)
cc6     pts/3     172.27.23.131        Wed    Apr    24    13:42    -    13:42    (00:00)     
cc4     pts/3     172.27.23.131        Wed    Apr    24    13:42    -    13:43    (00:01)     
cc7     pts/3     172.27.23.116        Wed    Apr    24    13:43    -    13:43    (00:00)     
cc1     pts/3     172.27.23.116        Wed    Apr    24    13:43    -    13:43    (00:00)     
cc8     pts/3     172.27.23.116        Wed    Apr    24    13:43    -    13:43    (00:00)     
swapnil     pts/3     172.27.23.116        Wed    Apr    24    13:44    -    13:47    (00:03)
cc3     pts/4     172.27.23.131        Wed    Apr    24    13:44    -    13:47    (00:03)
cc7     pts/5     172.27.23.246        Wed    Apr    24    13:45    -    13:46    (00:00)     
cc5     pts/3     172.27.23.123        Wed    Apr    24    13:46    -    13:47    (00:01)
swapnil     pts/3     172.27.23.116        Wed    Apr    24    13:44    -    13:47    (00:03)
cc3     pts/4     172.27.23.131        Wed    Apr    24    13:44    -    13:47    (00:03)
cc7     pts/5     172.27.23.246        Wed    Apr    24    13:45    -    13:46    (00:00)     
cc5     pts/3     172.27.23.123        Wed    Apr    24    13:46    -    13:55    (00:09)
gacanepa@debian $ cat logtest.txt | awk '/Apr/ && /24/' | wc -l
19
gacanepa@debian $

Hope you find this useful. Let us know if you need further help with #3.
Best regards.