Script to find users not logged in for 90 days

Dear All,

I need your help in finding out users not logged in to linux system for more than 90 days. I found a script from our forum i am getting error while using that.

from the code i have debugged line by line to see where i am getting the problem. i found out the below line i am getting error. I have provided the error details below.

llogin=$( date +%s -d"$umnt $uday, $year $uhour:$umin:01" )

Month: Apr  day:9 hour:07 min:45
Date:invalid date `Apr 9,2015 07:47:01`
User login.sh: line 37: 1428580770- : syntax error: operand expected (error token is "_ ")

Pleae help me and let me know If there is any other find the users notlogged in for more that 90days . FYI: I have around 250 users. for some users last command returns null.

I have attached script in which i did slight modification

thanks a lot in advance.

Does date +%s -d"Apr 9, 2015 07:47:01" work if you run it from the command line?

Hi Carlo,

No its not working getting same error like invalid date..

Works for me on Ubuntu linux3.16.0. What's your system and locale?

---------- Post updated at 22:36 ---------- Previous update was at 21:22 ----------

Given you are using awk anyhow, and several times, and hoping your date will eventually work, you might want to consider replacing your script with (an extended version of) this:

awk -F: '
BEGIN   {NOW=srand()}           

        {("last -1 " $1) | getline PW
         split (PW, USR, " ")
         if (USR[1]==$1)        {printf "%s %s, ",  $1, substr (PW, 40, 13)
                                 ("date +%s -d\""substr(PW, 40, 13)"\"") | getline LOG
                                 printf "%s\n", " logged in " int((NOW-LOG)/86400) " days ago."
                                }
         else print $1 " never logged in so far."
        }
        ' /etc/passwd

try this

for example notlogins for 90 days

# ./loginusers.sh notlogins 90
                     notlogins
              --------------------------
Last Login information for 'sync' could [not found] for 90 days
Last Login information for 'shutdown' could [not found] for 90 days
Last Login information for 'halt' could [not found] for 90 days
Last Login information for 'news' could [not found] for 90 days
Last Login information for 'ksh' could [not found] for 90 days
Last Login information for 'csh' could [not found] for 90 days
Last Login information for 'sftpuser' could [not found] for 90 days
Last Login information for 'sil' could [not found] for 90 days
Last Login information for 'vct' could [not found] for 90 days
Last Login information for 'ftptest' could [not found] for 90 days
Last Login information for 'ksh2' could [not found] for 90 days
Last Login information for '2' could [not found] for 90 days
Last Login time is long from period ['90'] of days ago for [3746ygem] user
Last Login information for 't2' could [not found] for 90 days
Last Login information for 'mysql' could [not found] for 90 days
.......................
............

for example only "test" user for 30 days

# ./loginusers.sh test 30

                test
=======================================================
Last Login Date ->  Tue Apr 14 15:19:01 EEST 2015
Elapsed Times (Days): 0.398252
Elapsed Times (Hours): 9.55806
Elapsed Times (Minutes): 573.483
Elapsed Times (Seconds): 34409
=======================================================

for example "3746ygem" user has a last login but not for in the 30 days

# ./loginusers.sh 3746ygem 30

Last Login time is long from period ['30'] of days ago for [3746ygem] user

# ./loginusers.sh 3746ygem 300

            3746ygem
=======================================================
Last Login Date ->  Thu Sep  4 15:38:01 EEST 2014
Elapsed Times (Days): 222.386
Elapsed Times (Hours): 5337.25
Elapsed Times (Minutes): 320235
Elapsed Times (Seconds): 19214113
=======================================================

for example only successfull last logins user for one day

# ./loginusers.sh logins 1
                        logins
              --------------------------

                root
=======================================================
Last Login Date ->  Tue Apr 14 22:28:01 EEST 2015
Elapsed Times (Days): 0.101528
Elapsed Times (Hours): 2.43667
Elapsed Times (Minutes): 146.2
Elapsed Times (Seconds): 8772
=======================================================

Last Login time is long from period ['1'] of days ago for [3746ygem] user

                test
=======================================================
Last Login Date ->  Tue Apr 14 15:19:01 EEST 2015
Elapsed Times (Days): 0.399444
Elapsed Times (Hours): 9.58667
Elapsed Times (Minutes): 575.2
Elapsed Times (Seconds): 34512
=======================================================

Last Login time is long from period ['1'] of days ago for [ucmdb] user

for example all last logs (logins and notlogins) from all users for last 5 day

# ./loginusers.sh 5

                root
=======================================================
Last Login Date ->  Wed Apr 15 09:48:01 EEST 2015
Elapsed Times (Days): 0.000405093
Elapsed Times (Hours): 0.00972222
Elapsed Times (Minutes): 0.583333
Elapsed Times (Seconds): 35
=======================================================

Last Login information for 'sync' could [not found] for 5 days
Last Login information for 'shutdown' could [not found] for 5 days
Last Login information for 'halt' could [not found] for 5 days
Last Login information for 'news' could [not found] for 5 days
Last Login information for 'ksh' could [not found] for 5 days
Last Login information for 'csh' could [not found] for 5 days
Last Login information for 'sftpuser' could [not found] for 5 days
Last Login information for 'sil' could [not found] for 5 days
Last Login information for 'vct' could [not found] for 5 days
Last Login information for 'ftptest' could [not found] for 5 days
Last Login information for 'ksh2' could [not found] for 5 days
Last Login information for '2' could [not found] for 5 days
Last Login time is long from period ['5'] of days ago for [3746ygem] user

                test
=======================================================
Last Login Date ->  Tue Apr 14 15:19:01 EEST 2015
Elapsed Times (Days): 0.770544
Elapsed Times (Hours): 18.4931
Elapsed Times (Minutes): 1109.58
Elapsed Times (Seconds): 66575
=======================================================

Last Login information for 't2' could [not found] for 5 days

# cat loginusers.sh
#!/bin/bash
## @ygemici unix.com last logins check script

# # # # # # # # # # # # # # # # #
# ./loginusers.sh notlogins 90  #
# ./loginusers.sh logins 90     #
# ./loginusers.sh username 90   #
# ./loginusers.sh 90            #
# # # # # # # # # # # # # # # # #

calldates() {
daysago=$(date -d "-$day days" +'%Y%m%d%H%M%S')
#lastyearstart=$(last|awk 'END{print $NF}')
validyear=$(date -d "-$day days" +'%Y')
}

writeerror() {
echo "Last Login information for '$1' could [not found] for $day days"
}

writelogin() {
nowepochtime=$(date +%s)
diff=$((nowepochtime-lastlgepochtime))
awk -vuser=$user 'BEGIN{printf "\n%20s\n",user}' ; awk 'BEGIN{$55=OFS="=";printf "%s\n",$0}'
awk -vdatex="$(date -d @${lastlgepochtime})" 'BEGIN{printf "%s%30s\n","Last Login Date -> ", datex}'
awk -vdiff=$diff 'BEGIN{printf "%20s%s\n%20s%s\n%20s%s\n%20s%s\n","Elapsed Times (Days): ",diff/60/60/24,"Elapsed Times (Hours): ",diff/60/60,"Elapsed Times
(Minutes): ",diff/60,"Elapsed Times (Seconds): ",diff}'
awk 'BEGIN{$55=OFS="=";print $0"\n"}'
}

calloldwtmp() {
lastlogf=$(ls -lt /var/log/wtmp*|awk 'END{print $NF}')
lasttyear=$(last -f $lastlogf|awk 'END{print $NF}')
}

calllastlogin() {
#lmonth=$(awk -vmonth=$lastmonthstart 'BEGIN{split("Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec",month," ");for(i=1;i<=12;i++)if(month~month)print i}'
)
calloldwtmp

for((i=$lasttyear;i<$validyear;i++)) ; do
lastlogl=$(last -t ${i}1231235959 -1 $user -f /var/log/wtmp*|awk 'NR==1')
j=$((i+1)) ; lastlogf=$(last -t ${j}1231235959 -1 $user -f /var/log/wtmp*|awk 'NR==1')

if [ "$lastlogl" == "$lastlogf" ] ; then
validyearnew=$i
else
validyearnew=$validyear
fi
done
lastlogin=$(last -1 $user -f /var/log/wtmp*|awk -vy=$validyearnew 'NR==1&&NF{print $5,$6,",",y,$7":01"}')
if [ -z "$lastlogin" ] ; then
 if [ "$1" = "notlogins" ] || [ "$1" = "$user" ] || [ -z "$1" ] ; then
 writeerror $user
 fi
else
 lastlgepochtime=$(date +%s -d"$lastlogin")
 wantedepochtime=$(date +%s -d"-$day days")
 if [ $lastlgepochtime -lt $wantedepochtime ] ; then
 echo "Last Login time is long from period ['$day'] of days ago for [$user] user"
 else
 if [ "$1" = "logins" ] || [ "$1" = "$user" ] || [ -z "$1" ] ; then
 writelogin $user
 fi
 fi
fi
}

calllastloginall() {
awk -F':' '$NF!~/nologin/{print $1}' $passwd | while read -r user ; do
if [ -z "$1" ] ; then
calllastlogin
else
calllastlogin $1
fi
done
}

checkuser() {
if [ "$1" != "notlogins" ] && [ "$1" != "logins" ] ; then
grep $1 $passwd 2>&1 >/dev/null
if [ $? -ne 0 ] ; then
echo "Username is seem invalid!!" ; exit 1
fi
else
awk -vn=$1 'BEGIN{printf "%30s\n",n}'
echo|awk 'BEGIN{printf "%15c","-";for(i=1;i<=25;i++)printf "%c","-"}END{printf "%s","\n"}'
fi
}

callfunc() {
case $1 in
 notlogins) calllastloginall notlogins ;;
 logins)  calllastloginall logins ;;
 *) user=$1 ; calllastlogin $user ;;
esac
}

numcheckandset() {
numcheck=$(echo|awk -va=$1 '{print a+=0}')
if [ $numcheck -eq 0 ] ; then echo "where is the period of day ? " ; exit 1 ; fi
passwd='/etc/passwd'
calldates
}

case $# in
 2) day=$2 ; numcheckandset $day ; checkuser $1 ; callfunc $1 ;;
 1) day=$1 ; numcheckandset $day ; calllastloginall ;;
 *) exit 1 ;;
esac

regards,
ygemici

thanks lot every one..
@ygemici thank you very much. I will try the code.

mean time that script is working when i changed the date format..like below.

llogin=$( date +%s -d"$umnt $uday $uhour:$umin:01 , $year" )