Searching the output of last

[Root Boy Jim]

lwall at jpl-devvax.JPL.NASA.GOV (Larry Wall) writes:

>If we can assume nobody is logged in overnight (or that records aren't kept),
>then I'd just process the output of "last", like this:

We have the opposite situation. lots of people logged on for a short time.

Here are a few interesting statistics:

11:37pm /USR/sys/conf [root at uunet 288] ll /usr/adm/wtmp
1224 -rw-r--r--  1 root     bin       1238724 Apr 29 23:37 /usr/adm/wtmp
11:37pm /USR/sys/conf [root at uunet 289] ll /USR/adm/wtmp
23128 -rw-rw-r--  1 root     wheel    23652936 Apr 28 10:04 /USR/adm/wtmp
11:50pm /USR/sys/conf [root at uunet 291] date;last|wc;date
Mon Apr 29 23:51:00 EDT 1991
   17354  162894 1214646
Mon Apr 29 23:53:56 EDT 1991
11:53pm /USR/sys/conf [root at uunet 292] 

The first file contains login records for today only.
The second is cumulative for the entire month.
We upgraded the OS yesterday, so you can extrapolate
that it would take about an hour alone to run last
on a whole month's statistics.

>last|perl -pe '$_ x=/(..:..)...(.*)/&&"'$1'"ge$1&&"'$1'"lt$2'
>
>That's gonna be tough for Randal to beat...  :-)

I just ran it with args 12:34 and 23:45. Here's the timing:
137.510u 88.580s 4:58.87 75% 0+0k 212+7io 0pf+0w

Five minutes for one day. Two and 1/2 hours for the entire month.

OK, so we're not a typical site :-)

>Larry
-- 
		[rbj at uunet 1] stty sane
		unknown mode: sane