Get the reboot and login duration

[joe_farage]

Hi all,

I need to get the restart and login duration of each Mac.
I've made a script that looks in the system.log file after reboot.
Is there a better way to get these two values?
Any advice is welcome
Best regards,
joe

#!/bin/sh

time1=$(grep "BOOT_TIME" /var/log/system.log | tail -n 1 | awk '{print $3}')
time2=$(grep "Login Window Started Security Agent" /var/log/system.log | tail -n 1 | awk '{print $3}')
time3=$(grep "User info context values set for" /var/log/system.log | grep SecurityAgent | tail -n 1 | awk '{print $3}')
time4=$(grep "Initialized sandbox" /var/log/system.log | grep fmfd | tail -n 1 | awk '{print $3}')

echo "BOOT_TIME	:	$time1" 
echo "LoginWindow	:	$time2" 
echo "User info context	:	$time3" 
echo "Initialized sandbox	:	$time4" 

sec1=$(date -j -f "%T" $time1 "+%s")
sec2=$(date -j -f "%T" $time2 "+%s")
sec3=$(date -j -f "%T" $time3 "+%s")
sec4=$(date -j -f "%T" $time4 "+%s")

diff1=$(($sec2-$sec1))
diff2=$(($sec4-$sec3))

echo "BOOT duration: $diff1 sec"
echo "LOGIN duration: $diff2 sec"

[nessts]

open a terminal and type

last reboot

[joe_farage]

No no no, it's the reboot time! Not the duration!

[nessts]

I would think that the time between reboots would be the login duration, if you just run last you can see who was logged in and for how long as well

[mm2270]

None of the above commands in your script return a value for me, so I suspect those entries may fall out of range of the log file after a time. Or, some other reason.

You can get the boot time with sysctl. The code I use in some of my scripts is:

sysctl kern.boottime | awk -F'[= |,]' '{print $6}'

That returns the actual system boot time in unix seconds, like:
1432049029
That can be piped through the date command to convert it if needed.

I'm not sure how to capture the time of login though. Maybe like?

last -t console | head -1 | awk '{print $3,$4,$5,$6}'

Probably better to get the time the loginwindow loads, but not certain on the best way to get that info.

[joe_farage]

Thanks @mm2270 ! I'll check that.
My script works just after a reboot..
With "login time" I mean the duration between entering credentials and the system is totally loaded and the user can start working.
Hope it's clear enough.
Kind regards
joe

[nessts]

@joe.farage good luck, and what would be the purpose for that out of curiosity?

@mm2270 you taught me something I had not learned in 17+ years of unix stuff with your -F'[= |,]' thanks!

[joe_farage]

@nessts there is an audit in our company for reboot and login speed on Mac and PC's. I'm in charge of all the Macs..

[nessts]

How can you possibly know when the desktop is ready to use without using a stopwatch and your eyes?

[mm2270]

I'm also a bit skeptical that an accurate login duration can be captured using just log information. I suppose it can give you something to report on to satisfy your auditing, but it will never really give you an accurate picture on this. But maybe that's not important in this case.

@nessts Your'e welcome! I can't even recall where I learned that trick, but its been handy to have.

[elliotjordan]

I'm also skeptical that a reliable metric can be gotten from this, but I'm following along eagerly hoping to be proven wrong.

Maybe something that checks pgrep "Finder$" to detect when the Finder launches, and then uses top -l 1 | awk '/CPU usage:/{print $7}' to check the CPU idle percentage? Just brainstorming here.

[nessts]

maybe a launch agent that touches a file but that could happen before a desktop is ready to use i suppose. unless there was a cocoa dialog box that had to be clicked OK and then it touched the file, of course that would mean that the user would have to click it really fast for the metric to be accurate.
interesting exercise for sure.

[mm2270]

I was also thinking that a login trigger or a LaunchAgent that ran at login that touched/updated a file with the time in unix seconds might be a good way to go. Then the Extension Attribute or script could pick up that value as part of its calculations. The problem is, how do you know when the user actually enters their password at the login screen? Is that reliably being recorded in the system.log or some other location? I'm not seeing anything very specific on my box.

[sean]

Check out the elapsed time of processes. Eg, process ID 1 (launchd) can be found using the ps command.

ps -p 1 -o etime

Using the same, you could test the elapsed time of any process, e.g. 'loginwindow console'. Grab the process ID and do the same thing.

You can also get timestamps of files. When a user logs in, this gets written to the login window plist.

stat -f%SB /Library/Preferences/com.apple.loginwindow.plist

or

stat -f%B /Library/Preferences/com.apple.loginwindow.plist

You could use the same command agains the users com.apple.dock.plist.

Just some maths then, with a little help from the date command.

I'd suggest for what you are trying to achieve, the difference between first process and login window process would suffice, as would the time difference between writing to the login window plist and when the dock has become active.