Home / server / Questions / 473998
In Process
andreas-h
Asked: 2013-01-31 14:14:12 +0800 CST

Find out how long a user was logged into a Linux server

  • 772

In my Debian Squeeze server, all user logins and logouts are recorded in the file /var/log/auth.log

Jan 28 07:11:06 xen8 sshd[29826]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 28 07:33:47 xen8 sshd[29826]: pam_unix(sshd:session): session closed for user root
Jan 28 09:45:58 xen8 sshd[14374]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 28 09:47:36 xen8 sshd[14374]: pam_unix(sshd:session): session closed for user root
Jan 29 07:37:48 xen8 sshd[24940]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 07:38:11 xen8 sshd[24940]: pam_unix(sshd:session): session closed for user root
Jan 29 08:35:13 xen8 sshd[25707]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 08:37:06 xen8 sshd[25707]: pam_unix(sshd:session): session closed for user root
Jan 29 16:59:39 xen8 sshd[30725]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 17:00:58 xen8 sshd[30725]: pam_unix(sshd:session): session closed for user root
Jan 29 17:11:17 xen8 sshd[30832]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 18:11:37 xen8 sshd[30832]: pam_unix(sshd:session): session closed for user root

Via the process id, one should be able to find matching logins/logouts, and then one could calculate the time. But my sed/awk skills are very limited, and maybe there's even a ready-made script/tool for this task out there? Is there an easy way to extract the times a user was logged in? Either in a total (per file), or maybe even with some nice graphics?

log-files

3 Answers

  1. The ac utility will provide you with statistics on the user login. For instance, to see the total number of secs/minutes/hours a user named user1 was on the system -

      ac -d user1

    output 

     Jan 22  total        4.19
 Jan 23  total        8.01
 Jan 24  total        7.84
 Jan 25  total        6.79
 Jan 28  total        7.37
 Jan 29  total        8.69
 Today   total        7.15
    • 7

  2. Try the last command. This should show you all the information you're looking for.

    • 5

  3. The final column of the output of the last command will show what you want 

    iain     pts/0        host          Mon Jan 28 22:44 - 23:12  (00:27)
    • 4