commandlinefu.com is the place to record those command-line gems that you return to again and again.
You can sign-in using OpenID credentials, or register a traditional username and password.
Subscribe to the feed for:
Add -n to last command to restrict to last num logins, otherwise it will pull all available history.
outputs a history of logins on the server (top 10, when piped to 'head'); optional flags: '-a' put the hostname at the end of the line (good for long hostnames), '-i' post the IP instead of the hostname, '-F' put the full login and logout times, rather than short times.
touch -t 201208211200 first ; touch -t 201208220100 last ;
creates 2 files: first & last, with timestamps that the find command should look between:
201208211200 = 2012-08-21 12:00
201208220100 = 2012-08-22 01:00
then we run find command with "-newer" switch, that finds by comparing timestamp against a reference file:
find /path/to/files/ -newer first ! -newer last
meaning: find any files in /path/to/files that are newer than file "first" and not newer than file "last"
pipe the output of this find command through xargs to a move command:
| xargs -ifile mv -fv file /path/to/destination/
and finally, remove the reference files we created for this operation:
rm first; rm last;
- more readable
Not really better - just different ;)
There's probably a really simple solution out there somewhere...
When your wtmp files are being logrotated, here's an easy way to unpack them all on the fly to see more than a week in the past. The rm is the primitive way to prevent symlink prediction attack.
This command will reveal login has been made to the system as well as when the reboot occurs. It uses a file called /var/log/wtmp,which captures all the information about the successful login and reboot information. It has many switch ,by which you can get an idea when people login how long they stay.
change 20 by the number of sessions you want to know (20 it's fair enough)
This command takes the output of the 'last' command, removes empty lines, gets just the first field ($USERNAME), sort the $USERNAMES in reverse order and then gives a summary count of unique matches.