I have created this program to see if a user is logged on and it checks every minute.

if [ "$#" -ne 1 ]
    echo "Usage: mon user"
    exit 1
until who | grep "^$user " > /dev/null
    sleep 60

echo "$user has logged on"

But my question is how can I modify this program to see if a user has logged off instead of logging in?

Thanks for any help provided! Much appreciated.

  • 1
    You could simply change until to while, but I do not think this is the most efficient or elegant method to be notified of user login activity. – jw013 Nov 13 '14 at 0:51
  • Couldn't just use -v with the grep to and print out that user is not logged in? Of course, it won't tell you whether the user had logged in and then logged out, but would just tell you whether the user is logged in at the moment. – Citylight Nov 13 '14 at 4:52

Try this.


[ "$#" -ne 1 ] && {
    echo "Usage: $(basename $0) user"
    exit 1

grep "^$user:" /etc/passwd > /dev/null || {
    echo "There's no user called $user in this system."
    exit 2

who | grep "^$user " > /dev/null && sleep 60

echo "$user has logged out"

You can filter the secure log file (assuming you are just checking for remote login). The secure log file tells you when a user logs in and logs out. Also check the lastlog command as well as the wtmp and utmp files. They'll contain historical data for user logins.

  • /var/log/secure may not be set up in all distros. I think systemd has thrown away /var/log in favor of journalctl. I like the idea of using who\ w better as this will include those who are logged in non-remotely. – SailorCire Nov 13 '14 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.