#!/usr/bin/perl -w use strict; sub read_utmp_record { my $file=shift; my $record; my $rawdata; my $bytes=read($file, $rawdata, 2); if ($bytes==0) { #no more return 0; } $record->{ut_type}=unpack("s", $rawdata); read($file, $rawdata, 2); #skip read($file, $rawdata, 4); $record->{ut_pid}=unpack("I", $rawdata); $record->{ut_line}=''; for (my $i=0; $i<32; $i++) { read($file, $rawdata, 1); $record->{ut_line}=$record->{ut_line}.unpack("a", $rawdata); } $record->{ut_id}=''; for (my $i=0; $i<4; $i++) { read($file, $rawdata, 1); $record->{ut_id}=$record->{ut_id}.unpack("a", $rawdata); } $record->{ut_user}=''; for (my $i=0; $i<32; $i++) { read($file, $rawdata, 1); my $c=unpack("a", $rawdata); $record->{ut_user}=$record->{ut_user}.unpack("a", $rawdata); } $record->{ut_host}=''; for (my $i=0; $i<256; $i++) { read($file, $rawdata, 1); $record->{ut_host}=$record->{ut_host}.unpack("a", $rawdata); } read($file, $rawdata, 2); $record->{e_termination}=unpack("s", $rawdata); read($file, $rawdata, 2); $record->{e_exit}=unpack("s", $rawdata); read($file, $rawdata, 4); $record->{ut_session}=unpack("I", $rawdata); read($file, $rawdata, 4); $record->{tv_sec}=unpack("I", $rawdata); read($file, $rawdata, 4); $record->{tv_usec}=unpack("I", $rawdata); #let's ignore the rest for now read($file, $rawdata, 36); return $record; } open(UTMP_FILE, "/var/run/utmp") || die(''); binmode(UTMP_FILE); my @a=(); while (my $record=read_utmp_record(\*UTMP_FILE)) { push(@a, $record); } close(UTMP_FILE); foreach my $record (@a) { if ($record->{ut_type}==7) { print $record->{ut_user}, "\t", $record->{ut_line}, "\t", scalar(localtime($record->{tv_sec})), "\t", "($record->{ut_host})", "\n"; } }