Script to Analyze 'last' Data

+8

ryan_panning
Author
Contributor
Forum|Forum|14 years ago
February 22, 2011

get the top most user. Using PHP (attached) I did this by a regex
pattern and such. I'm sure something similar could be done with Bash,
just not as familiar yet. Any input would be great. Thanks!

~ Ryan

------_=_NextPart_002_01CBD2D6.08952B09
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v"urn:schemas-microsoft-com:vml" xmlns:o"urn:schemas-microsoft-com:office:office" xmlns:w"urn:schemas-microsoft-com:office:word" xmlns:m"http://schemas.microsoft.com/office/2004/12/omml" xmlns"http://www.w3.org/TR/REC-html40"><head><meta http-equivContent-Type content"text/html; charsetus-ascii"><meta nameGenerator content"Microsoft Word 14 (filtered medium)"><style></style></head><body langEN-US linkblue vlinkpurple><div classWordSection1>Ok, this is an offshoot of the other “Script Priority” topic I started earlier today.<o:p></o:p><o:p> </o:p>What I’d like to do is calculate what user has been logged into the computer the longest. Not the last, most recent user. So far I have a PHP script that processes the ‘last’ output and calculates the session times, sorts it and gets the top user. From there, I do an LDAP lookup to get the real user name, but that’s already in Bash/sh. I’d have done this all in Bash to start with but I’m more familiar with PHP.<o:p></o:p><o:p> </o:p>So, to start out, I can get the data needed by calling this command. I’m sure you understand this one, but just in case. “Last” is getting a list of all computer/user sessions. “Grep” is getting just the console/desktop sessions. And finally, “awk” is getting just the columns/fields that I need.<o:p></o:p><o:p> </o:p>last | grep console | awk '{print $1 " " $NF}'<o:p></o:p><o:p> </o:p>From there, I need to add each users session time, sort the totals, and get the top most user. Using PHP (attached) I did this by a regex pattern and such. I’m sure something similar could be done with Bash, just not as familiar yet. Any input would be great. Thanks!<o:p> </o:p>~ Ryan<o:p></o:p></div></body></html>
------_=_NextPart_002_01CBD2D6.08952B09--

------_=_NextPart_001_01CBD2D6.08952B09
Content-Type: text/plain; name="getLongestUser.php.txt"
Content-Transfer-Encoding: base64
Content-Description: getLongestUser.php.txt
Content-Disposition: attachment; filename="getLongestUser.php.txt"

IyEvdXNyL2Jpbi9waHAKPD9waHAKCi8vIEdldCByYXcgb3V0cHV0IGZyb20gdGhlIHNoZWxsCiRz
ZXNzaW9ucyA9IHNoZWxsX2V4ZWMoJ2xhc3QgfCBncmVwIGNvbnNvbGUgfCBhd2sgXCd7cHJpbnQg
JDEgIiAiICRORn1cJycpOwoKLy8gU2VwYXJhdGUgZWFjaCBsaW5lIGludG8gc2Vzc2lvbnMKJHNl
c3Npb25zID0gZXhwbG9kZShQSFBfRU9MLCAkc2Vzc2lvbnMpOwoKLy8gUmVtb3ZlIGxhc3QgbGlu
ZSBpZiBlbXB0eQppZiAoZW5kKCRzZXNzaW9ucykgPT0gJycpIHsKICAgIGFycmF5X3BvcCgkc2Vz
c2lvbnMpOwp9CgovLyBTZXBhcmF0ZSBlYWNoIHNlc3Npb24gZnJvbSB0aGUgdXNlciBhbmQgdGlt
ZQphcnJheV93YWxrKCRzZXNzaW9ucywgY3JlYXRlX2Z1bmN0aW9uKCcmJGUsJGsnLCAnJGU9ZXhw
bG9kZSgiICIsICRlKTsnKSk7CgovLyBQbGFjZWhvbGRlciBmb3IgdXNlciA9PiBsb2dnZWQtaW4g
dGltZXMKJGxvZ2luX3RpbWVzID0gYXJyYXkoKTsKCi8vIExvb3AgdGhyb3VnaCBlYWNoIHNlc3Np
b24KZm9yZWFjaCAoJHNlc3Npb25zIGFzICRzZXNzaW9uKSB7CgogICAgLy8gTGlzdCB0aGUgc2Vz
c2lvbiBkZXRhaWxzCiAgICBsaXN0KCR1c2VyLCAkdGltZSkgPSAkc2Vzc2lvbjsKCiAgICAvLyBJ
Z25vcmUgcG9vcmx5IGZvcm1hdHRlZCB0aW1lcwogICAgLy8gRWxzZSBwYXJzZSB0aGUgdGltZSB0
byBnZXQgZCtoaDptbQogICAgaWYgKCFwcmVnX21hdGNoKCcvXCgoKFxkKylcKyk/KFxkezJ9KVw6
KFxkezJ9KVwpLycsICR0aW1lLCAkbWF0Y2hlcykpIHsKICAgICAgICBjb250aW51ZTsKICAgIH0K
CiAgICAvLyBDb252ZXJ0IHRvIG1pbnV0ZXMKICAgICR0aW1lICA9ICAoaW50KSAkbWF0Y2hlc1s0
XTsKICAgICR0aW1lICs9ICgoaW50KSAkbWF0Y2hlc1szXSAqIDYwKTsKICAgICR0aW1lICs9ICgo
aW50KSAkbWF0Y2hlc1syXSAqIDI0ICogNjApOwoKICAgIC8vIEFkZCB1c2VycyBzZXNzaW9uIHRp
bWUgdG8gdGhlIHRvdGFsIGxvZ2dlZC1pbiB0aW1lCiAgICBAJGxvZ2luX3RpbWVzWyR1c2VyXSAr
PSAkdGltZTsKfQoKLy8gU29ydCBieSBsb2dnZWQtaW4gdGltZQphcnNvcnQoJGxvZ2luX3RpbWVz
LCBTT1JUX05VTUVSSUMpOwoKLy8gR2V0IHRvcCBtb3N0IHVzZXIKJHVzZXJuYW1lID0gKHN0cmlu
Zykga2V5KCRsb2dpbl90aW1lcyk7CgovLyBXcml0ZSB1c2VybmFtZSB0byB0ZW1wb3JhcnkgZmls
ZQokZmlsZSA9IEBmb3BlbignL3ByaXZhdGUvdG1wL3VzZXJfbmFtZS50eHQnLCAndycpOwpmd3Jp
dGUoJGZpbGUsICR1c2VybmFtZSk7CmZjbG9zZSgkZmlsZSk7CgovLyBSZXR1cm4gdGhlIHJlc3Vs
dAplY2hvICJMb25nZXN0IFVzZXI6ICR1c2VybmFtZSI7Cg=

------_=_NextPart_001_01CBD2D6.08952B09--

Like

T

+31

tlarkin
Honored Contributor
Forum|Forum|14 years ago
February 22, 2011

Casper keeps a complete list of the last log under the usage logs. Here is a snippet

Action

Who

Date

login 14devlov Wednesday, September 01 2010 at 7:28 AM

startup

Wednesday, September 01 2010 at 7:27 AM

login 14devlov Tuesday, August 24 2010 at 7:27 AM

startup

Tuesday, August 24 2010 at 7:26 AM

login 14devlov Saturday, August 07 2010 at 12:05 PM

startup

Saturday, August 07 2010 at 12:04 PM

startup

Thursday, July 22 2010 at 9:04 AM

login hadmin Wednesday, July 21 2010 at 3:40 PM

startup

Wednesday, July 21 2010 at 3:38 PM

startup

Wednesday, July 21 2010 at 3:16 PM

login 12jascor Tuesday, May 11 2010 at 11:00 AM

startup

Tuesday, May 11 2010 at 10:59 AM

login 12jascor Tuesday, May 04 2010 at 9:23 AM

startup

Tuesday, May 04 2010 at 9:21 AM

login 12jascor Thursday, April 29 2010 at 9:26 AM

How does this differ from what you are trying to accomplish here? You
want this to basically see the difference and time a user logs in versus
another?

--missing content--

get the top most user. Using PHP (attached) I did this by a regex
pattern and such. Iâ€™m sure something similar could be done with Bash,
just not as familiar yet. Any input would be great. Thanks!

~ Ryan

This message has been sent from the Kansas City, Kansas Public Schools.
The information contained in this email and any attachments may be
privileged and confidential, and are intended only for the individual or
entity identified as the addressee. If you are not the addressee, or if
the message has been addressed to you in error, you are not authorized
to read, retain, copy, or distribute the message or any attachments. If
you have received the message in error, please delete it and any
attachments and notify the sender by return e-mail or by telephone.
Thank you.

--=Part68444C03.1
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Content-Description: HTML

</head> <body vlink"purple" link"blue" lang"EN-US"> Casper keeps a complete list of the last log under the usage logs.  Here is a snippet 
 <table> <tr>
 </tr> <tr valign"top"> <td background"images/sub.gif"> <table border"0" width"100%" cellpadding"0" cellspacing
"0"> <tr> <td background"images/column_header.gif" height"15"> <table border"0" width"100%" cellpadding"0" cellspacing"0"> <tr> <td nowrap"nowrap" align"center">  Action  </td> <td width"5">
 </td> </tr> </table> </td> </tr> </table> </td> <td background"images/sub.gif"> <table border"0" width"100%" cellpadding"0" cellspacing
"0"> <tr> <td background"images/column_header.gif" height"15"> <table border"0" width"100%" cellpadding"0" cellspacing"0"> <tr> <td width"10">
 </td> <td nowrap"nowrap" align"center">  Who  </td> <td width"5">
 </td> </tr> </table> </td> </tr> </table> </td> <td background"images/sub.gif"> <table border"0" width"100%" cellpadding"0" cellspacing
"0"> <tr> <td background"images/column_header.gif" height"15"> <table border"0" width"100%" cellpadding"0" cellspacing"0"> <tr> <td width"10">
 </td> <td nowrap"nowrap" align"center">  Date  </td> <td width"5">
 </td> </tr> </table> </td> </tr> </table> </td> </tr> <tr bgcolor"#ffffff"> <td>   login  </td> <td>  14devlov  </td> <td>  Wednesday, September 01 2010 at 7:28 AM  </td> </tr> <tr bgcolor"#eeeeee"> <td>   startup  </td> <td>    </td> <td>  Wednesday, September 01 2010 at 7:27 AM  </td> </tr> <tr bgcolor"#ffffff"> <td>   login  </td> <td>  14devlov  </td> <td>  Tuesday, August 24 2010 at 7:27 AM  </td> </tr> <tr bgcolor"#eeeeee"> <td>   startup  </td> <td>    </td> <td>  Tuesday, August 24 2010 at 7:26 AM  </td> </tr> <tr bgcolor"#ffffff"> <td>   login  </td> <td>  14devlov  </td> <td>  Saturday, August 07 2010 at 12:05 PM  </td> </tr> <tr bgcolor"#eeeeee"> <td>   startup  </td> <td>    </td> <td>  Saturday, August 07 2010 at 12:04 PM  </td> </tr> <tr bgcolor"#ffffff"> <td>   startup  </td> <td>    </td> <td>  Thursday, July 22 2010 at 9:04 AM  </td> </tr> <tr bgcolor"#eeeeee"> <td>   login  </td> <td>  hadmin  </td> <td>  Wednesday, July 21 2010 at 3:40 PM  </td> </tr> <tr bgcolor"#ffffff"> <td>   startup  </td> <td>    </td> <td>  Wednesday, July 21 2010 at 3:38 PM  </td> </tr> <tr bgcolor"#eeeeee"> <td>   startup  </td> <td>    </td> <td>  Wednesday, July 21 2010 at 3:16 PM  </td> </tr> <tr bgcolor"#ffffff"> <td>   login  </td> <td>  12jascor  </td> <td>  Tuesday, May 11 2010 at 11:00 AM  </td> </tr> <tr bgcolor"#eeeeee"> <td>   startup  </td> <td>    </td> <td>  Tuesday, May 11 2010 at 10:59 AM  </td> </tr> <tr bgcolor"#ffffff"> <td>   login  </td> <td>  12jascor  </td> <td>  Tuesday, May 04 2010 at 9:23 AM  </td> </tr> <tr bgcolor"#eeeeee"> <td>   startup  </td> <td>    </td> <td>  Tuesday, May 04 2010 at 9:21 AM  </td> </tr> <tr bgcolor"#ffffff"> <td>   login  </td> <td>  12jascor  </td> <td>  Thursday, April 29 2010 at 9:26 AM  </td> </tr> </table>
 How does this differ from what you are trying to accomplish here?  You want this to basically see the difference and time a user logs in versus another?</f
ont> >>> "Panning, Ryan" <Ryan.Panning at dis
trict196.org> 2/22/2011 3:18 PM >>> <div class"wordsection1"> Ok, this is an offshoot of the other “Script Priority” topic I started earlier today.<o p"#DEFAULT"></o> <o p"#DEFAULT">  </o> What I’d like to do is calculate what user has been logged into the computer the longest. Not the last, most recent user. So far I have a PHP script that processes the ‘last’ output and calculates the session times, sorts it and gets the top user. From there, I do an LDAP lookup to get the real user name, but that’s already in Bash/sh. I’d have done this all in Bash to start with but I’m more familiar with PHP.<o p"#DEFAULT"></o> <o p"#DEFAULT">  </o> So, to start out, I can get the data needed by calling this command. I’m sure you understand this one, but just in case. “Last” is getting a list of all computer/user sessions. “Grep” is getting just the console/desktop sessions. And finally, “awk” is getting just the columns/fields that I need.<o p"#DEFAULT"></o> <o p"#DEFAULT">  </o> last | grep console | awk '{print $1 " " $NF}'<o p"#DEFAULT"></o> <o p"#DEFAULT">  </o> From there, I need to add each users session time, sort the totals, and get the top most user. Using PHP (attached) I did this by a regex pattern and such. I’m sure something similar could be done with Bash, just not as familiar yet. Any input would be great. Thanks! <o p"#DEFAULT">  </o> ~ Ryan<o p"#DEFAULT"></o> </div>

<div> This message has been sent from the Kansas City, Kansas Public Schools. The information contained in this email and any attachments may be privileged and confidential, and are intended only for the individual or entity identified as the addressee. If you are not the addressee, or if the message has been addressed to you in error, you are not authorized to read, retain, copy, or distribute the message or any attachments. If you have received the message in error, please delete it and any attachments and notify the sender by return e-mail or by telephone.

Thank you. </div> </BODY></HTML>

--=Part68444C03.1=--

Like

E

+21

ernstcs
Contributor
Forum|Forum|14 years ago
February 22, 2011

Not exactly the same thing...

We actually have scripts that run at login and logout that curl data to a webpage that then places the data into a separate MySQL schema. We can then use this data for determining lab usage, unique logins and number of them. Could use it for duration if we wanted to. It's also used for another system that allows students to find available lab computers.

Not sure if a whole new system is what you're after, but it works well here. I'd share the scripts if there is interest.

Don't recall what would work for this that already exists in the JSS.

Like

R

+8

ryan_panning
Author
Contributor
Forum|Forum|14 years ago
February 22, 2011

Alright, end goal, to populate a computers Username and Real Name in Casper. We have policies setup to schedule Recon to run once per month. Right now the policies just have the Update Inventory checked in the Advanced tab. I would change this to instead run the command `jamf recon –endUsername “<<from script>>” –realname “<<from script>>”`.

In education, most computers are going to be used by several users. But the teacher computers are mostly used by, well, the teachers. But, students may login to the computer as well. In this case the student may be the “last” user but it’s really the teachers computer. That’s why a proper calculation would be better.

So my thoughts are, run a script to do the calculation. Then set the username and realname in temporary files so that the jamf recon command can `cat /private/tmp/user_name.txt`, get the username and realname from those temporary files.

~ Ryan

Like

R

+8

ryan_panning
Author
Contributor
Forum|Forum|14 years ago
February 22, 2011

That sounds like a good idea for gauging computer usage. But we're just
looking to populate the field in Casper to help with inventory searches
and have the name show up in Remote. Mainly things in Casper. Thanks for
the offer though.

~ Ryan