Find out how long a user was logged into a Linux server

Question

In my Debian Squeeze server, all user logins and logouts are recorded in the file /var/log/auth.log

Jan 28 07:11:06 xen8 sshd[29826]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 28 07:33:47 xen8 sshd[29826]: pam_unix(sshd:session): session closed for user root
Jan 28 09:45:58 xen8 sshd[14374]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 28 09:47:36 xen8 sshd[14374]: pam_unix(sshd:session): session closed for user root
Jan 29 07:37:48 xen8 sshd[24940]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 07:38:11 xen8 sshd[24940]: pam_unix(sshd:session): session closed for user root
Jan 29 08:35:13 xen8 sshd[25707]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 08:37:06 xen8 sshd[25707]: pam_unix(sshd:session): session closed for user root
Jan 29 16:59:39 xen8 sshd[30725]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 17:00:58 xen8 sshd[30725]: pam_unix(sshd:session): session closed for user root
Jan 29 17:11:17 xen8 sshd[30832]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 18:11:37 xen8 sshd[30832]: pam_unix(sshd:session): session closed for user root

Via the process id, one should be able to find matching logins/logouts, and then one could calculate the time. But my sed/awk skills are very limited, and maybe there's even a ready-made script/tool for this task out there? Is there an easy way to extract the times a user was logged in? Either in a total (per file), or maybe even with some nice graphics?

Answer 1

The ac utility will provide you with statistics on the user login. For instance, to see the total number of secs/minutes/hours a user named user1 was on the system -

  ac -d user1

output

 Jan 22  total        4.19
 Jan 23  total        8.01
 Jan 24  total        7.84
 Jan 25  total        6.79
 Jan 28  total        7.37
 Jan 29  total        8.69
 Today   total        7.15

Answer 2

Try the last command. This should show you all the information you're looking for.

Answer 3

The final column of the output of the last command will show what you want

iain     pts/0        host          Mon Jan 28 22:44 - 23:12  (00:27)