Looking at user login time with the ac command

While not a very well known Linux command, ac can provide very useful stats on user login time. In its simplest form, it will show you how much time users have spent on the system in the time period covered by the wtmp file. All you have to type is “ac” to get a figure showing overall login time for all users.

$ ac total 8360.60

The figure above indicates that users spent a total of 8,360.6 hours on the system. Looking at the wtmp file with the who command, we can see that the saved logins started on June 6th – a little more than 6 months earlier.

$ who /var/log/wtmp | head -2 shs tty2 2022-06-06 16:00 (tty2) shs pts/1 2022-06-06 16:23 (192.168.0.12)

To look at the times by user, add the -p (people) argument.

$ ac -p popeye 1081.10 nemo 2301.70 shark 801.00 shs 4176.80 total 8360.6

To look at daily login totals, you can use the ac -d (day) command. Add a grep command if you only want to see login times for one month.

$ ac -d | grep Oct | head -11 Oct 1 total 46.21 Oct 2 total 55.09 Oct 3 total 34.50 Oct 4 total 69.48 Oct 5 total 50.73 Oct 6 total 44.85 Oct 7 total 25.05 Oct 8 total 74.49 Oct 9 total 44.88 Oct 10 total 34.28 Oct 11 total 38.36

Piping the output of the ac -d command to the head command is another way to see how far back the wtmp file goes.

$ ac -d | head -1 Jun 6 total 82.92

You can also pipe the ac output to the tail command to see the most recent days. This provides the current day as well as earlier days in the month.

$ ac -d | tail -10 Nov 1 total 121.79 Nov 2 total 24.86 Nov 3 total 25.75 Nov 4 total 24.63 Nov 5 total 25.03 Nov 7 total 52.97 Nov 8 total 26.86 Nov 9 total 27.66 Nov 10 total 24.56 Today total 14.91

If you have wtmp data from some other time period or system saved in a file, you can run an ac command against that file like this:

$ ac -f /var/log/Jupiter total 5434.7

The ac -h (help) command will provide a summary of the command’s many options.

$ ac -h Usage: ac [OPTION] ... OPTIONS: -d, --daily-totals Print totals for each day -p, --individual-totals Print time totals for each user -f, --file Read from --complain Print errors for whatever problem --reboots Count the time between login and reboot --supplants Count the time between logins on the terminal --timewarps Count the time between login and time warp --compatibility Shortcut for --reboots --supplants --timewarps -a, --all-days Do not skip days without login activity --tw-leniency Set the time warp leniency in seconds --tw-suspicious Set the time warp suspicious in seconds --print-year Print year when displaying dates --print-zeros Don't suppress zeros in category totals --debug Print verbose internal information -V, --version Show version and exit -h, --help Show help and exit

The system's default login accounting file is /var/log/wtmp. While the ac command's summaries are generally more useful, you can view every entry in that file if you see the need. Use the who /var/log/wtmp command as shown below. Piping its output to the more command will allow you to slowly move through the details and get a feel for how much and how often the particular system is being used.

$ who /var/log/wtmp | more shs pts/1 2022-06-07 06:40 (192.168.0.6) shs pts/2 2022-06-07 08:26 (192.168.0.12) shark pts/3 2022-06-07 09:00 (192.168.0.12) nemo pts/2 2022-06-07 10:09 (192.168.0.11) nemo pts/2 2022-06-07 11:05 (192.168.0.11) nemo pts/2 2022-06-07 12:12 (192.168.0.6) shs pts/2 2022-06-07 13:50 (192.168.0.12) nemo pts/2 2022-06-07 14:15 (192.168.0.11) shs pts/1 2022-06-06 16:23 (192.168.0.12) shs tty2 2022-06-06 16:00 (tty2) shs pts/1 2022-06-06 17:32 (192.168.0.12) shs tty2 2022-06-06 17:17 (tty2) shs tty2 2022-06-06 17:21 (tty2) shs pts/1 2022-06-06 18:35 (192.168.0.6) shark pts/2 2022-06-07 18:26 (192.168.0.6)

Wrap-up

The ac command makes information stored in the wtmp file more accessible. If you want to know how much time users spend logged into a system or how often they log in, it’s just what you need. Likely standing for “accounting”, the ac command allows you to view data in the wtmp file in several very useful ways.