Xref: utzoo comp.sources.wanted:16458 comp.unix.questions:30872
Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!usc!cs.utexas.edu!uunet!mcsun!ukc!slxsys!ibmpcug!demon!cliff
From: cliff@demon.co.uk (Cliff Stanford)
Newsgroups: comp.sources.wanted,comp.unix.questions
Subject: Re: Searching the output of last
Keywords: last awk sed perl C whatever
Message-ID: <1991Apr29.210435.227@demon.co.uk>
Date: 29 Apr 91 21:04:35 GMT
References: <1991Apr28.070748.5279@bradley.bradley.edu>
Organization: Demon Systems Limited
Lines: 60

In article <1991Apr28.070748.5279@bradley.bradley.edu> guru@buhub.bradley.edu (Jerry Whelan) writes:
>
>	Does anyone have/know of a program to parse the output of the
>'last' command and tell me who was logged in at some arbitrary time?
>I'd like to be able to type: 
>
>			whenwho 9:56
>
>and get a list of all the people who were logged in during that particular
>minute.  My site resets the wtmp file at 4 AM, so we are not dealing with
>infinite output from 'last.'  Awk, perl, C or anything that works reasonably
>quickly is fine with me.

	I just knoked the following up.  Don't blame me if it's
full of bugs or non-prtable.  It works for me!
		Cliff.

#!/bin/sh
# whenwho
last | gawk -v wanted=$1 '
BEGIN	{
		wmin = whr = wanted
		sub(/.*:/, "", wmin)
		sub(/:.*/, "", whr)
		}

FNR==1	{ next }

		{
		min = hr = $8
		sub(/.*:/, "", min)
		sub(/:.*/, "", hr)
		if (hr < whr)
			next
		if (hr == whr && min < wmin)
			next
		if (hr > whr && min > wmin)
			next
		emin = ehr = $9
		sub(/.*:/, "", emin)
		sub(/:.*/, "", ehr)
		hr += ehr
		min += emin
		if (min > 59)
			{
			hr++
			min -= 60
			}
		if (hr < whr)
			next
		if (hr == whr && min < wmin)
			next
		print $1
		}
' | sort | uniq
-- 
Cliff Stanford				Email:	cliff@demon.co.uk (Work)
Demon Systems Limited				cms@demon.co.uk   (Home)
42 Hendon Lane				Phone:	081-349 0063	  (Office)
London	N3 1TT	England				0860 375870	  (Mobile)