Find all users that logged in at a specific date and from a specific machine

Question

I would like to write a bash script, that takes two parameters as input (day hostname) and outputs the username of all users that logged in on the day of the current month and from the address of hostname.

I have written this code until now:

#!/bin/bash

#parameter correction checking
if [ ! $# -eq 2 ]
then echo "You have input the wrong number of parameters!"
fi

#Current month checking
CurrentMonth=`date | cut -d' ' -f2`
#This will contain the abbreviation of the current month: e.g "Mar"

#$2 -> IP/hostname; $1 -> day (of the current month)
last | grep '$2' | grep '$CurrentMonth $1' | cut -d' ' -f1
#here the two greps will get the lines that check out our requirements, and the cut will return only the username

What did I do wrong? The code runs just fine if I replace the CurrentMonth variable with Mar and the $2 with an actual IP address

user_15087622 · Answer

Everything between single quotes ('') will get treated as literal text and variables won't get expanded. Instead use double quotes ("") for strings that contain variables.

Note that you can always debug a bash script and get the expanded commands shown if you start it with bash -x yourscript or change the shebang to #!/bin/bash -x.

A working version of your script would look like that:

#!/bin/bash

#parameter correction checking
if [ ! $# -eq 2 ]
then echo "You have input the wrong number of parameters!"
fi

#Current month checking
CurrentMonth=`date | cut -d' ' -f2`
#This will contain the abbreviation of the current month: e.g "Mar"

#$2 -> IP/hostname; $1 -> day (of the current month)
last | grep "$2" | grep "$CurrentMonth $1" | cut -d' ' -f1
#here the two greps will get the lines that check out our requirements, and the cut will return only the username

Notes:

last by default prints an abbreviated username, you might want to add the -w flag to print the full name.

Also note that instead of grep you could use lasts builtin functions for filtering by time:

-s, --since time
           Display the state of logins since the specified time. This is useful, e.g., to easily determine who was logged in at a particular time. The option is often combined with --until.

-t, --until time
           Display the state of logins until the specified time.

TIME FORMATS
       The options that take the time argument understand the following formats:

       ┌────────────────────┬────────────────────────────────────────────┐
       │                    │                                            │
       │YYYYMMDDhhmmss      │                                            │
       ├────────────────────┼────────────────────────────────────────────┤
       │                    │                                            │
       │YYYY-MM-DD hh:mm:ss │                                            │
       ├────────────────────┼────────────────────────────────────────────┤
       │                    │                                            │
       │YYYY-MM-DD hh:mm    │ (seconds will be set to 00)                │
       ├────────────────────┼────────────────────────────────────────────┤
       │                    │                                            │
       │YYYY-MM-DD          │ (time will be set to 00:00:00)             │
       ├────────────────────┼────────────────────────────────────────────┤
       │                    │                                            │
       │hh:mm:ss            │ (date will be set to today)                │
       ├────────────────────┼────────────────────────────────────────────┤
       │                    │                                            │
       │hh:mm               │ (date will be set to today, seconds to 00) │
       ├────────────────────┼────────────────────────────────────────────┤
       │                    │                                            │
       │now                 │                                            │
       ├────────────────────┼────────────────────────────────────────────┤
       │                    │                                            │
       │yesterday           │ (time is set to 00:00:00)                  │
       ├────────────────────┼────────────────────────────────────────────┤
       │                    │                                            │
       │today               │ (time is set to 00:00:00)                  │
       ├────────────────────┼────────────────────────────────────────────┤
       │                    │                                            │
       │tomorrow            │ (time is set to 00:00:00)                  │
       ├────────────────────┼────────────────────────────────────────────┤
       │                    │                                            │
       │+5min               │                                            │
       ├────────────────────┼────────────────────────────────────────────┤
       │                    │                                            │
       │-5days              │                                            │
       └────────────────────┴────────────────────────────────────────────┘

Find all users that logged in at a specific date and from a specific machine

1 Answers