Unix and Linux network configuration. Multiple network interfaces. Bridged NICs. High-availability network configurations.


Reviews of latest Unix and Linux software. Helpful tips for application support admins. Automating application support.


Disk partitioning, filesystems, directories, and files. Volume management, logical volumes, HA filesystems. Backups and disaster recovery.


Distributed server monitoring. Server performance and capacity planning. Monitoring applications, network status and user activity.

Commands & Shells

Cool Unix shell commands and options. Command-line tools and application. Things every Unix sysadmin needs to know.

Home » Commands & Shells, Security

Show Logged In Users During a Time Window

Submitted by on February 17, 2018 – 2:59 pm

Let’s say you want to see who was logged in on the server during last weekend. This includes users who, say, logged in on Thursday and haven’t logged out until Saturday afternoon.

The newer version of the last command includes two options: -s (starting time) and -t (ending time). This makes our task simple:

last -wda -s $(date -d'Satrday last week' +'%Y%m%d%H%M%S') -t $(date -d'Monday last week' +'%Y%m%d%H%M%S')

The older versions of last only have the -t option, which makes things a bit more interesting. You can try to update the package that provides last. Here’s an example using yum:

yum update $(awk '{print $1}' <(head -1 <(grep -B2 ^Repo.*installed <(yum provides `which last` 2>&1))))

However, this is not likely to get you the desired version of the sysvinit-tools package. The solution is to run last twice for two overlapping time intervals and use diff to extract the desired time window:

diff --new-line-format="" --unchanged-line-format="" <(last -wda -t $(date -d'Monday last week' +'%Y%m%d%H%M%S')) <(last -wda -t $(date -d'Saturday last week' +'%Y%m%d%H%M%S'))

user2 pts/2        Sun Jan  7 21:57    gone - no logout  laptop2.domain.local
user1 pts/1        Sun Jan  7 18:15    gone - no logout  laptop1.domain.local
user1 pts/0        Sat Jan  6 16:54 - 04:34  (11:40)     laptop1.domain.local


Print Friendly, PDF & Email

Leave a Reply