I need to schedule a weekly report that will run every Sunday at 10:00 PM that will show all accounts (usernames and IP addresses) that have logged into the server. This output would be sent to the email.

I would like to make use of "last" & "mail" commands for this purpose.

The cron would look something like the below but the '-a' option will list the entire logged in users info. Whereas, I'm looking for the users info who have logged in the previous week only. How this can be achieved?

0 22 * * 0 /usr/bin/last -a | mail -s "SSH Logins Report" -r user@domain.com

Server Info

OS: CentOS Linux release 7.5

Kernel: 3.10.0-862.2.3.el7.x86_64

  • Care to give some more info? What is this "last" command? Is this "report" some kind of script/program? – Mr Shunz Sep 5 '18 at 15:57
  • "last" is a built-in command. /usr/bin/last - Shows the listing of all the last logged in users on a linux machine. – Srikanth Sep 6 '18 at 6:43

I'd use utmpdump command for that, as it has Year in it's output

for weekday in 'monday' 'tuesday' 'wednesday' 'thursday' 'friday' 'saturday' 'sunday' ;
    /usr/bin/utmpdump /var/log/wtmp | grep "`date --date \"$weekday week ago\" '+%a %b %d\s[^ ]*\s%Y'`" 
done 2> /dev/null

last -a > ${LAST_OUTPUT_FILE}

for i in {1..6}
        DATE_TO_SEARCH=$(date -d"-${i}days" "+%b %d" | sed  "s/.\([1-9]\)/ \1/")
mail -s "SSH Logins Report" -r user@domain.com < ${OUTPUT_FILE}
echo "Output File : ${OUTPUT_FILE}"
echo "Last File extract : ${LAST_OUTPUT_FILE}"
  • there is no Year in output of last. So it will show outputs of any year with the same date. – Alexander Sep 6 '18 at 9:19
  • yes.. thats true – Kamaraj Sep 6 '18 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.