Ubuntu – Bash command to determine first login for a particular time period

bashcommand line

Is there a way to determine for example that the current day is the first login for this month? I'm trying to use it in my script. I am familiar with last but it does not seem to be the command for this job.

Let's take this for an example:

  • If today is first login of the month, echo "first!"
  • else echo "nope"

Sample Scenario:

July 2 is my first login for the month of July, I logged in 5 times that day. It must only echo "first" on my first login and "nope" on the subsequent 4.

Best Answer

Using last and awk

last -R "$USER" | \
    perl -ne 'print unless /wtmp\sbegins/ || /^$/' | \
    awk 'END {print $4,$5,$6}'

last searches back through the file /var/log/wtmp (or the file designated by the -f flag) and displays a list of all users logged in (and out) since that file was created.

Per default /var/log/wtmp is created on every new month:

% awk '/\/var\/log\/wtmp/,/}/' /etc/logrotate.conf 
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

last -R $USER returns all entries from /var/log/wtmp for the given user. The first login is placed at the bottom of the output, therefore the END in my awk command.

% last -R "$USER"   
aboettge pts/1        Wed Jul 15 12:04   still logged in   
aboettge pts/1        Wed Jul 15 11:29 - 12:04  (00:34)    
aboettge pts/1        Wed Jul 15 08:08 - 11:29  (03:21)    
aboettge pts/1        Wed Jul 15 08:08 - 08:08  (00:00)    
aboettge pts/1        Wed Jul 15 08:07 - 08:08  (00:00)    
aboettge tty2         Wed Jul 15 08:03   still logged in   
aboettge pts/1        Tue Jul 14 12:58 - down   (00:53)    
aboettge pts/1        Tue Jul 14 09:06 - 12:58  (03:51)    
aboettge pts/1        Tue Jul 14 09:03 - 09:06  (00:02)    
aboettge pts/1        Tue Jul 14 08:23 - 09:03  (00:40)    
aboettge pts/1        Tue Jul 14 08:22 - 08:23  (00:00)    
aboettge tty2         Tue Jul 14 08:22 - down   (05:28)    
aboettge pts/1        Mon Jul 13 12:01 - 16:26  (04:24)    
aboettge pts/1        Mon Jul 13 11:49 - 11:59  (00:10)    
aboettge pts/1        Mon Jul 13 11:46 - 11:49  (00:02)    
aboettge tty2         Mon Jul 13 11:44 - down   (04:42)    
aboettge pts/2        Mon Jul 13 11:26 - 11:35  (00:08)    
aboettge tty2         Mon Jul 13 11:25 - down   (00:09)    
aboettge pts/3        Fri Jul 10 14:26 - 14:28  (00:01)    
aboettge pts/3        Fri Jul 10 14:23 - 14:26  (00:03)    
aboettge pts/2        Fri Jul 10 13:34 - 15:27  (01:53)    
aboettge pts/2        Fri Jul 10 13:31 - 13:31  (00:00)    
aboettge pts/2        Fri Jul 10 13:25 - 13:30  (00:05)    
aboettge pts/2        Fri Jul 10 10:28 - 13:19  (02:50)    
aboettge pts/1        Fri Jul 10 08:35 - 15:27  (06:52)    
aboettge tty2         Fri Jul 10 08:00 - down   (07:28)    
aboettge pts/1        Thu Jul  9 16:25 - 16:27  (00:01)    
aboettge tty2         Thu Jul  9 16:21 - down   (00:06)    
aboettge tty1         Thu Jul  9 16:03 - crash  (00:00)    
aboettge tty1         Thu Jul  9 15:29 - 16:03  (00:33)    
aboettge pts/1        Thu Jul  9 14:32 - 14:32  (00:00)    
aboettge pts/1        Thu Jul  9 08:51 - 08:51  (00:00)    
aboettge pts/1        Thu Jul  9 08:51 - 08:51  (00:00)    
aboettge pts/1        Thu Jul  9 08:50 - 08:51  (00:00)    
aboettge pts/1        Thu Jul  9 08:46 - 08:46  (00:00)    
aboettge pts/1        Thu Jul  9 08:46 - 08:46  (00:00)    
aboettge pts/1        Thu Jul  9 08:45 - 08:45  (00:00)    
aboettge pts/1        Thu Jul  9 08:44 - 08:44  (00:00)    
aboettge pts/1        Thu Jul  9 08:42 - 08:42  (00:00)    
aboettge pts/1        Thu Jul  9 08:42 - 08:42  (00:00)    
aboettge pts/1        Thu Jul  9 08:42 - 08:42  (00:00)    
aboettge pts/1        Thu Jul  9 08:41 - 08:41  (00:00)    
aboettge pts/1        Thu Jul  9 08:41 - 08:41  (00:00)    
aboettge pts/1        Thu Jul  9 08:40 - 08:41  (00:00)    
aboettge pts/1        Thu Jul  9 08:39 - 08:39  (00:00)    
aboettge pts/1        Thu Jul  9 08:38 - 08:38  (00:00)    
aboettge pts/1        Thu Jul  9 08:36 - 08:36  (00:00)    
aboettge pts/1        Thu Jul  9 08:36 - 08:36  (00:00)    
aboettge pts/1        Thu Jul  9 08:36 - 08:36  (00:00)    
aboettge pts/1        Thu Jul  9 08:35 - 08:35  (00:00)    
aboettge pts/1        Thu Jul  9 08:35 - 08:35  (00:00)    
aboettge pts/2        Thu Jul  9 07:50 - 16:03  (08:12)    
aboettge :0           Thu Jul  9 07:50 - crash  (08:13)    
aboettge pts/1        Wed Jul  8 16:13 - 16:27  (00:13)    
aboettge pts/2        Wed Jul  8 13:47 - 16:27  (02:39)    
aboettge pts/1        Wed Jul  8 11:30 - 14:14  (02:44)    
aboettge pts/1        Wed Jul  8 08:18 - 11:29  (03:11)    
aboettge :0           Wed Jul  8 08:02 - crash  (23:47)    
aboettge pts/2        Tue Jul  7 08:54 - 08:55  (00:00)    
aboettge pts/1        Tue Jul  7 08:02 - 13:13  (05:10)    
aboettge :0           Tue Jul  7 07:50 - down   (05:23)    
aboettge pts/1        Mon Jul  6 09:55 - 14:48  (04:53)    
aboettge :0           Mon Jul  6 08:27 - crash  (23:19)    
aboettge pts/2        Fri Jul  3 07:52 - 15:30  (07:38)    
aboettge :0           Fri Jul  3 07:51 - down   (07:40)    
aboettge pts/2        Thu Jul  2 15:16 - 15:18  (00:01)    
aboettge pts/2        Thu Jul  2 15:07 - 15:07  (00:00)    
aboettge pts/1        Thu Jul  2 14:46 - 16:21  (01:35)    
aboettge pts/1        Thu Jul  2 09:53 - 09:53  (00:00)    
aboettge pts/2        Thu Jul  2 08:00 - 14:41  (06:40)    
aboettge :0           Thu Jul  2 08:00 - crash  (23:47)    
aboettge pts/5        Wed Jul  1 14:16 - 14:38  (00:21)    
aboettge pts/3        Wed Jul  1 14:01 - 16:10  (02:09)    
aboettge pts/2        Wed Jul  1 13:27 - 16:10  (02:42)    
aboettge pts/1        Wed Jul  1 13:22 - 16:10  (02:48)    
aboettge :0           Wed Jul  1 13:15 - 16:21  (03:05)    
aboettge pts/2        Wed Jul  1 11:30 - 11:36  (00:06)    
aboettge pts/1        Wed Jul  1 11:29 - 13:02  (01:32)    
aboettge pts/1        Wed Jul  1 11:27 - 11:29  (00:01)    
aboettge pts/2        Wed Jul  1 08:28 - 11:27  (02:58)    

wtmp begins Wed Jul  1 08:28:18 2015

Example

% last -R "$USER" | perl -ne 'print unless /wtmp\sbegins/ || /^$/' | awk 'END {print $4,$5,$6}'
Jul 1 08:28

Breakdown

  • % last -R "$USER"

    see above

  • perl -ne 'print unless /wtmp\sbegins/ || /^$/'

    removes empty lines and wtmp begins …

  • awk 'END {print $4,$5,$6}'

    prints the fields 4, 5 and 6 from the last line, the default separator is (a space)