深入了解linux下的last命令及其数据源
last
数据源： /var/log/wtmp（默认 记录每个用户的登录次数和持续时间等信息）和/var/log/btmp(详细，包括登录失败请求)
数据源格式：二进制（可以通过dump-utmp 命令进行阅读）
last [-adRx][-f ][-n ][帐号名称...][终端机编号...]
图1 last 命令格式
参数说明：
-a 把从何处登入系统的主机名称或IP地址，显示在最后一行。
-d 将IP地址转换成主机名称。
-f <记录文件> 指定记录文件，默认是显示/var/log目录下的wtmp文件的记录，但/var/log目录下得btmp能显示的内容更丰富，可以显示远程登录，例如ssh登录 ，包括失败的登录请求。
-n <显示列数>或-<显示列数> 设置列出名单的显示列数。
-R 不显示登入系统的主机名称或IP地址。
-x 显示系统关机，重新开机，以及执行等级的改变等信息。
-i 显示特定ip登录的情况
-t 显示YYYYMMDDHHMMSS之前的信息
实例1
last
图2 last
正常命令重启显示为down，而电源强制重启为crash
字段介绍：
第一列：用户名
第二列：终端位置
第三列：登录ip或者内核
第四列：开始时间
第五列：结束时间（still login in 还未退出 down 直到正常关机 crash 直到强制关机）
第六列：持续时间
实例2
last -x
图3 last -x
实例3
last -n
图4 last -x -n
实例4
last -f /var/log/btmp | head -100
图5 last -f /var/log/btmp | head -100
实例5
last -t 20130819090800
显示2013-08-19 09：09：00之前的登录信息
图6 last -t 20130819090800
深入了解-晋级
结构
utmp文件中保存的是当前正在本系统中的用户的信息。
wtmp文件中保存的是登录过本系统的用户的信息。
/var/log/wtmp 文件结构和/var/run/utmp 文件结构一样，都是引用/usr/include/bits/utmp.h 中的struct utmp
/* The `struct utmp' type, describing entries in the utmp file. GNU version. Copyright (C) 1993, 1996, 1997, 1998, 1999, 2002 Free Software Foundation, Inc. This file is part of the GNU C Library. The GNU C Library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any later version. The GNU C Library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with the GNU C Library; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA. */#ifndef _UTMP_H# error "Never include <bits/utmp.h> directly; use <utmp.h> instead."#endif#include <paths.h>#include <sys/time.h>#include <sys/types.h>#include <bits/wordsize.h>#define UT_LINESIZE32#define UT_NAMESIZE32#define UT_HOSTSIZE256/* The structure describing an entry in the database of previous logins. */struct lastlog {#if __WORDSIZE == 64 && defined __WORDSIZE_COMPAT32 int32_t ll_time;#else __time_t ll_time;#endif char ll_line[UT_LINESIZE]; char ll_host[UT_HOSTSIZE]; };/* The structure describing the status of a terminated process. This type is used in `struct utmp' below. */struct exit_status { short int e_termination;/* Process termination status. */ short int e_exit;/* Process exit status. */ };/* The structure describing an entry in the user accounting database. */struct utmp{ short int ut_type;/* Type of login. */ pid_t ut_pid;/* Process ID of login process. */ char ut_line[UT_LINESIZE];/* Devicename. */ char ut_id[4];/* Inittab ID. */ char ut_user[UT_NAMESIZE];/* Username. */ char ut_host[UT_HOSTSIZE];/* Hostname for remote login. */ struct exit_status ut_exit;/* Exit status of a process marked as DEAD_PROCESS. *//* The ut_session and ut_tv fields must be the same size when compiled 32- and 64-bit. This allows data files and shared memory to be shared between 32- and 64-bit applications. */#if __WORDSIZE == 64 && defined __WORDSIZE_COMPAT32 int32_t ut_session;/* Session ID, used for windowing. */ struct { int32_t tv_sec;/* Seconds. */ int32_t tv_usec;/* Microseconds. */ } ut_tv;/* Time entry was made. */#else long int ut_session;/* Session ID, used for windowing. */ struct timeval ut_tv;/* Time entry was made. */#endif int32_t ut_addr_v6[4];/* Internet address of remote host. */ char __unused[20];/* Reserved for future use. */};/* Backwards compatibility hacks. */#define ut_nameut_user#ifndef _NO_UT_TIME/* We have a problem here: `ut_time' is also used otherwise. Define _NO_UT_TIME if the compiler complains. */# define ut_timeut_tv.tv_sec#endif#define ut_xtimeut_tv.tv_sec#define ut_addrut_addr_v6[0]/* Values for the `ut_type' field of a `struct utmp'. */#define EMPTY0/* No valid user accounting information. */#define RUN_LVL1/* The system's runlevel. */#define BOOT_TIME2/* Time of system boot. */#define NEW_TIME3/* Time after system clock changed. */#define OLD_TIME4/* Time when system clock changed. */#define INIT_PROCESS5/* Process spawned by the init process. */#define LOGIN_PROCESS6/* Session leader of a logged in user. */#define USER_PROCESS7/* Normal process. */#define DEAD_PROCESS8/* Terminated process. */#define ACCOUNTING9/* Old Linux name for the EMPTY type. */#define UT_UNKNOWNEMPTY/* Tell the user that we have a modern system with UT_HOST, UT_PID, UT_TYPE, UT_ID and UT_TV fields. */#define _HAVE_UT_TYPE1#define _HAVE_UT_PID1#define _HAVE_UT_ID1#define _HAVE_UT_TV1#define _HAVE_UT_HOST1
而读取和修改这些文件的函数如下(/usr/include/utmp.h)：
/* Copyright (C) 1993, 1996, 1997, 1998, 1999 Free Software Foundation, Inc. This file is part of the GNU C Library. The GNU C Library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any later version. The GNU C Library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with the GNU C Library; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA. */#ifndef_UTMP_H#define_UTMP_H1#include <features.h>#include <sys/types.h>__BEGIN_DECLS/* Get system dependent values and data structures. */#include <bits/utmp.h>/* Compatibility names for the strings of the canonical file names. */#define UTMP_FILE_PATH_UTMP#define UTMP_FILENAME_PATH_UTMP#define WTMP_FILE_PATH_WTMP#define WTMP_FILENAME_PATH_WTMP/* Make FD be the controlling terminal, stdin, stdout, and stderr; then close FD. Returns 0 on success, nonzero on error. */extern int login_tty (int __fd) __THROW;/* Write the given entry into utmp and wtmp. */extern void login (__const struct utmp *__entry) __THROW;/* Write the utmp entry to say the user on UT_LINE has logged out. */extern int logout (__const char *__ut_line) __THROW;/* Append to wtmp an entry for the current time and the given info. */extern void logwtmp (__const char *__ut_line, __const char *__ut_name, __const char *__ut_host) __THROW;/* Append entry UTMP to the wtmp-like file WTMP_FILE. */extern void updwtmp (__const char *__wtmp_file, __const struct utmp *__utmp) __THROW;/* Change name of the utmp file to be examined. */extern int utmpname (__const char *__file) __THROW;/* Read next entry from a utmp-like file. */extern struct utmp *getutent (void) __THROW;/* Reset the input stream to the beginning of the file. */extern void setutent (void) __THROW;/* Close the current open file. */extern void endutent (void) __THROW;/* Search forward from the current point in the utmp file until the next entry with a ut_type matching ID->ut_type. */extern struct utmp *getutid (__const struct utmp *__id) __THROW;/* Search forward from the current point in the utmp file until the next entry with a ut_line matching LINE->ut_line. */extern struct utmp *getutline (__const struct utmp *__line) __THROW;/* Write out entry pointed to by UTMP_PTR into the utmp file. */extern struct utmp *pututline (__const struct utmp *__utmp_ptr) __THROW;#ifdef__USE_MISC/* Reentrant versions of the file for handling utmp files. */extern int getutent_r (struct utmp *__buffer, struct utmp **__result) __THROW;extern int getutid_r (__const struct utmp *__id, struct utmp *__buffer, struct utmp **__result) __THROW;extern int getutline_r (__const struct utmp *__line,struct utmp *__buffer, struct utmp **__result) __THROW;#endif/* Use misc. */__END_DECLS#endif /* utmp.h */
utmpname()函数设定utmp文件所在的路径，默认的路径为宏 _PATH_UTMP，该宏定义在/usr/include/paths.h中
#define _PATH_UTMP "/var/run/utmp"
setutent()函数打开文件utmp，并且将文件指针指向文件的最开始。
getutent()函数从文件utmp中，每次读取一个struct utmp的结构体。读取失败返回NULL。
endutent()函数关闭文件utmp。
pututline()函数将一个struct utmp结构体写进文件utmp中。
下面根据这些知识写一个模仿Linux下的who命令的小程序(mywho.c).
#include <stdio.h>#include <stdlib.h>#include <utmp.h>#include <time.h>int main(){ struct utmp *p_utent; long t; setutent(); /* rewinds the file pointer to the beginning of the utmp file */ while((p_utent = getutent()) != NULL){ if(p_utent->ut_type != USER_PROCESS) continue; printf("%s\t", p_utent->ut_user); printf("%s\t", p_utent->ut_line); t = p_utent->ut_tv.tv_sec; printf("%.20s\t", ctime(&t) + 4); printf("(%s)\n", p_utent->ut_host); } endutent(); /* closes the utmp file. */ return 0;}编译
gcc -o mywho mywho.c
运行
./mywho
图7 mywho运行结果
在上面的程序中增加下面一条语句，就可以读取曾经登录过本系统的用户信息
utmpname(_PATH_WTMP); /* #define _PATH_WTMP "/var/log/wtmp" */
#include <stdio.h>#include <stdlib.h>#include <utmp.h>#include <time.h>int main(){ struct utmp *p_utent; long t; utmpname(_PATH_WTMP); /* #define _PATH_WTMP "/var/log/wtmp" */ setutent(); /* rewinds the file pointer to the beginning of the utmp file */ while((p_utent = getutent()) != NULL){ if(p_utent->ut_type != USER_PROCESS) continue; printf("%s\t", p_utent->ut_user); printf("%s\t", p_utent->ut_line); t = p_utent->ut_tv.tv_sec; printf("%.20s\t", ctime(&t) + 4); printf("(%s)\n", p_utent->ut_host); } endutent(); /* closes the utmp file. */ return 0;}
编译
gcc -o mywho mywho.c
运行
./mywho
图8 mywho运行结果（所以用户登录信息）
在上面那些函数是非线程安全的，不可重入的，因为它们将返回结果保存在一个static变量中，可以被后面相同的调用所覆盖。
对应可重入的版本如下(/usr/include/utmp.h)：
#define _GNU_SOURCE /* or _SVID_SOURCE or _BSD_SOURCE */#include <utmp.h>int getutent_r(struct utmp *ubuf, struct utmp **ubufp);int getutid_r(struct utmp *ut, struct utmp *ubuf, struct utmp **ubufp);int getutline_r(struct utmp *ut, struct utmp *ubuf, struct utmp **ubufp);