Understanding the Output of the `who -a` Command

sshdUtilities

I am asking this question because, while there are many answers on the internet showing that who -a is an option, nobody explains how to read the output. If you could provide a link to an online site that explains this, that would be equally an awesome answer. Here is an example of what I would like to decipher:

[bo@hostname ~]$ who -a
                        Jun 17 03:47               590 id=si    term=0 exit=0
           system boot  Jun 17 03:47
           run-level 3  Jun 17 03:47                   last=S
                        Jun 17 03:48              4424 id=l3    term=0 exit=0
LOGIN      tty1         Jun 17 03:48              5503 id=1
LOGIN      tty2         Jun 17 03:48              5504 id=2
LOGIN      tty3         Jun 17 03:48              5505 id=3
LOGIN      tty4         Jun 17 03:48              5506 id=4
LOGIN      tty5         Jun 17 03:48              5507 id=5
LOGIN      tty6         Jun 17 03:48              5508 id=6
           pts/0        Oct 19 16:27             15250 id=ts/0  term=0 exit=0
bo       + pts/1        Oct 23 12:24   .         19776 (10.10.10.93)
           pts/2        Oct 23 13:07              8551 id=ts/2  term=0 exit=0
           pts/3        Oct 22 10:36              5813 id=ts/3  term=0 exit=0
           pts/4        Oct 10 09:06             13002 id=ts/4  term=0 exit=0

Best Answer

As you can find from man who

-a, --all
      same as -b -d --login -p -r -t -T -u

So let's look in details:

-b, --boot
      time of last system boot

this is string system boot Jun 17 03:47

-d, --dead
      print dead processes

this is strings with exit=0 at the end

-l, --login
      print system login processes

this is login ttys (strings with LOGIN in the beginning)

-p, --process
      print active processes spawned by init

this

-r, --runlevel
      print current runlevel

this is run-level 3 Jun 17 03:47 last=S

next one is

-T, -w, --mesg
      add user's message status as +, - or ?
-u, --users
      list users logged in

this two string

bo       + pts/1        Oct 23 12:24   .         19776 (10.10.10.93)

Hope now it is more clear how to parse this output.

Related Solutions

Shell Text Processing – Doing Two Things with Output from a Command

You can use a anonymous pipe for the second command:

texcount foo.tex | tee >(sed s/$/'\\\\'/ > wc.tex)

Store output of a command into a ring-buffer

You can get some of what you want via pipelog, which "allows for rotating or clearing the log of a running process by piping it through an intermediate which responds to external signals", e.g.:

spewstuff | pipelog spew.log -p /tmp/spewpipe.pid -x "gzip spew.log.1"

You can then get the pid from /tmp/spewpipe.pid, and:

kill -s USR1 $(</tmp/spewpipe.pid)

But that you would have to set up with cron or something. There's one catch to this, however. Notice I gzip spew.log.1 -- this is because the -x command is executed after the log is rotated. So you have the further problem of overwriting spew.log.1.gz each time unless you write a short script to do the gzip and move the file afterward, and use that as the -x command.

Full disclosure: I wrote this, so it of course works perfectly. ;) I will keep a compress option in mind, or something that better facilitates it, for version 0.2 (the intended purpose of -x is somewhat different, but it will work as above). Also automated rollover is a good idea...the first version is intentionally minimal as I resisted the temptation to add features that weren't necessary (it is not so hard to set up a cron job for this, after all).

Note that it's intended for text output; if there are potential null bytes, you should use -z -- which replaces the zero with something else. This was a tradeoff to simplify the implementation.

Best Answer

Related Solutions

Shell Text Processing – Doing Two Things with Output from a Command

Store output of a command into a ring-buffer

Related Question