Originally published January 13, 2018 @ 12:27 pm

Let’s say you want to see who was logged in on the server during last weekend. This includes users who, say, logged in on Thursday and haven’t logged out until Saturday afternoon.

The newer version of the last command includes two options: -s (starting time) and -t (ending time). This makes our task simple:

last -wda -s $(date -d'Satrday last week' +'%Y%m%d%H%M%S') -t $(date -d'Monday last week' +'%Y%m%d%H%M%S')

The older versions of last only have the -t option, which makes things a bit more interesting. You can try to update the package that provides last. Here’s an example using yum:

yum update $(awk '{print $1}' <(head -1 <(grep -B2 ^Repo.*installed <(yum provides `which last` 2>&1))))

However, this is not likely to get you the desired version of the sysvinit-tools package. The solution is to run last twice for two overlapping time intervals and use diff to extract the desired time window:

diff --new-line-format="" --unchanged-line-format="" <(last -wda -t $(date -d'Monday last week' +'%Y%m%d%H%M%S')) <(last -wda -t $(date -d'Saturday last week' +'%Y%m%d%H%M%S'))

user2 pts/2        Sun Jan  7 21:57    gone - no logout  laptop2.domain.local
user1 pts/1        Sun Jan  7 18:15    gone - no logout  laptop1.domain.local
user1 pts/0        Sat Jan  6 16:54 - 04:34  (11:40)     laptop1.domain.local

 

Related ArticlesMore From Author