Searching the output of last

[Cliff Stanford]

In article <1991Apr28.070748.5279 at bradley.bradley.edu> guru at buhub.bradley.edu (Jerry Whelan) writes:
>
>	Does anyone have/know of a program to parse the output of the
>'last' command and tell me who was logged in at some arbitrary time?
>I'd like to be able to type: 
>
>			whenwho 9:56
>
>and get a list of all the people who were logged in during that particular
>minute.  My site resets the wtmp file at 4 AM, so we are not dealing with
>infinite output from 'last.'  Awk, perl, C or anything that works reasonably
>quickly is fine with me.

	I just knoked the following up.  Don't blame me if it's
full of bugs or non-prtable.  It works for me!
		Cliff.

#!/bin/sh
# whenwho
last | gawk -v wanted=$1 '
BEGIN	{
		wmin = whr = wanted
		sub(/.*:/, "", wmin)
		sub(/:.*/, "", whr)
		}

FNR==1	{ next }

		{
		min = hr = $8
		sub(/.*:/, "", min)
		sub(/:.*/, "", hr)
		if (hr < whr)
			next
		if (hr == whr && min < wmin)
			next
		if (hr > whr && min > wmin)
			next
		emin = ehr = $9
		sub(/.*:/, "", emin)
		sub(/:.*/, "", ehr)
		hr += ehr
		min += emin
		if (min > 59)
			{
			hr++
			min -= 60
			}
		if (hr < whr)
			next
		if (hr == whr && min < wmin)
			next
		print $1
		}
' | sort | uniq
-- 
Cliff Stanford				Email:	cliff at demon.co.uk (Work)
Demon Systems Limited				cms at demon.co.uk   (Home)
42 Hendon Lane				Phone:	081-349 0063	  (Office)
London	N3 1TT	England				0860 375870	  (Mobile)