Commands using last (19)
-
This command takes the output of the 'last' command, removes empty lines, gets just the first field ($USERNAME), sort the $USERNAMES in reverse order and then gives a summary count of unique matches. Show Sample Output
15last | grep -v "^$" | awk '{ print $1 }' | sort -nr | uniq -c -
When your wtmp files are being logrotated, here's an easy way to unpack them all on the fly to see more than a week in the past. The rm is the primitive way to prevent symlink prediction attack.
5( last ; ls -t /var/log/wtmp-2* | while read line ; do ( rm /tmp/wtmp-junk ; zcat $line 2>/dev/null || bzcat $line ) > /tmp/junk-wtmp ; last -f /tmp/junk-wtmp ; done ) | less -
3last reboot
-
1last | awk '{ print $1 }' | sort | uniq -c | grep -v wtmp
-
change 20 by the number of sessions you want to know (20 it's fair enough) Show Sample Output
1last -n 20 -
Not really better - just different ;) There's probably a really simple solution out there somewhere... Show Sample Output
1netstat -atn | perl -0777 -ne '@ports = /tcp.*?\:(\d+)\s+/imsg ; for $port (32768..61000) {if(!grep(/^$port$/, @ports)) { print $port; last } }' -
outputs a history of logins on the server (top 10, when piped to 'head'); optional flags: '-a' put the hostname at the end of the line (good for long hostnames), '-i' post the IP instead of the hostname, '-F' put the full login and logout times, rather than short times.
1last -aiF | head -
0last | awk '$1!~/wtmp/{logs[$1]++}END{for (i in logs) print i, logs[i]}'
-
0last reboot
-
- shorter - more readable Show Sample Output
0last reboot -
touch -t 201208211200 first ; touch -t 201208220100 last ; creates 2 files: first & last, with timestamps that the find command should look between: 201208211200 = 2012-08-21 12:00 201208220100 = 2012-08-22 01:00 then we run find command with "-newer" switch, that finds by comparing timestamp against a reference file: find /path/to/files/ -newer first ! -newer last meaning: find any files in /path/to/files that are newer than file "first" and not newer than file "last" pipe the output of this find command through xargs to a move command: | xargs -ifile mv -fv file /path/to/destination/ and finally, remove the reference files we created for this operation: rm first; rm last;
0touch -t 201208211200 first ; touch -t 201208220100 last ; find /path/to/files/ -newer first ! -newer last | xargs -ifile mv -fv file /path/to/destination/ ; rm first; rm last; -
0last
-
Get an approximation of who the workstation is assigned to. You can wrap it in su - "$()" if you want to log into a shell as that user. Show Sample Output
0last | grep -i console | grep -iv 'root' | cut -f 1 -d ' ' | sort | uniq -c | sort -nr | awk '{print $2}' | head -1 -
0last -x | grep shutdown | head -1
-
FQPN - Path = Filename
0Print everything after last slash -
Add -n to last command to restrict to last num logins, otherwise it will pull all available history. Show Sample Output
-1last|grep `whoami`|grep -v logged|cut -c61-71|sed -e 's/[()]//g'|awk '{ sub("\\+", ":");split($1,a,":");if(a[3]){print a[1]*60*60+a[2]*60+a[3]} else {print a[1]*60+a[2] }; }'|paste -s -d+ -|bc|awk '{printf "%dh:%dm:%ds\n",$1/(60*60),$1%(60*60)/60,$1%60}' -
-2git last commit on a file.
-
This command will reveal login has been made to the system as well as when the reboot occurs. It uses a file called /var/log/wtmp,which captures all the information about the successful login and reboot information. It has many switch ,by which you can get an idea when people login how long they stay. Show Sample Output
-3last -
-7last reboot
What's this?
commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.
Check These Out
Stay in the loop…
- Follow the Tweets.
-
Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.
» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10 - Subscribe to the feeds.
-
Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):
Subscribe to the feed for:
- » all commands
- » commands with 3 up-votes (commandlinefu3)
- » commands with 10 up-votes (commandlinefu10)
- » commands using last