Wednesday, October 21, 2009

How many times each user has logged in

With this line, we can check how many times our users had logged in with SSH:

cat /etc/passwd | cut -d ":" -f 1 | sort | uniq | while read line ; do echo -n $line" "; zgrep "user $line" /var/log/auth.log* | grep -i ssh | grep -vi fail | grep -vi invalid | wc -l; done | sort -n -r -k 2

On my system, the only user which has logged in was my own user:
filipi 52

And for non SSH logins:
cat /etc/passwd | cut -d ":" -f 1 | sort | uniq | while read line ; do echo -n $line" "; zgrep "user $line" /var/log/auth.log* | grep -vi fail | grep -vi invalid | wc -l; done | sort -n -r -k 2

No comments:

Post a Comment