15

I'm trying to figure out a process that monitors users sessions on a remote server and alerts them when they are being idle too long, which with the Linux command w is aptly appropriate.

Problem is - w uses 3 different formats to specify the idle time of the session, and I can't figure them out properly. An output of w might look like this:

 11:40:57 up 400 days, 10:46, 13 users,  load average: 5.07, 5.10, 4.83
USER     TTY      FROM           LOGIN@   IDLE   JCPU   PCPU WHAT
john     pts/1    XX.XX.XX.XX   Wed13   22:29m  0.13s  0.04s ssh master-db
june     pts/2    XX.XX.XX.XX   Wed13   46.00s  0.67s  0.13s -bash
jenn     pts/4    XX.XX.XX.XX   11:13   27:47   4.16s  0.11s -bash

As you can see, IDLE has different formats for each of the users:

  • "AA.BBs" obviously means that AA seconds and BB 1/100ths of a second (46 seconds in the case of June) has passed since she was last active on the console.
  • "AA:BBm" probably means that AA hours and BB minutes have passed since John was last active on his session.
  • "AA:BB" is the format I can't figure out - how long has Jennifer not being active in her session?
Guss
  • 2,670
  • 5
  • 34
  • 59

4 Answers4

10

From the man page

The standard format is DDdays, HH:MMm, MM:SS or SS.CC if the times are greater than 2 days, 1hour, or 1 minute respectively.

so your output is MM:SS (>1m and <1 hour).

user9517
  • 115,471
  • 20
  • 215
  • 297
7

Without a qualifier, it means MM:SS -- that is, minutes and whole seconds. As an added bonus, there's a fourth format you don't have in that output -- a number of days (NNdays) of inactivity.

womble
  • 96,255
  • 29
  • 175
  • 230
3

The answer is 27minutes and 47seconds

  1. default format is MM:SS.
  2. 22:29m means 22 hours and 29 minutes
  3. 46.00s means 46 seconds
  4. 4d means 4 days
Kexin Z
  • 31
  • 1
1

Not quite the answer to your question, but an easier approach to checking the idle time of login sessions would be to look at /dev/pts. The modification times of the files in there reflect the last time the login session received input.

You should be able to do stat operations there (e.g., stat --format="%n %X" *), and keep everything in epoch seconds. Should make any time calculations easier.

To obtain current time epoch in seconds you can use date +%s.

vidarlo
  • 6,654
  • 2
  • 18
  • 31
cjc
  • 24,916
  • 3
  • 51
  • 70
  • 1
    If you find yourself parsing time formats, you might want to look for a source of that timestamp in epoch time. – cjc Aug 18 '11 at 12:23
  • 1
    I read something about that, but I've noticed that the idle times reported by `w` are different then the timestamps on the `/dev/pts` files. any idea why? – Guss Aug 20 '11 at 09:31
  • In what context is it different? I haven't looked at this carefully, but "w" must be pulling the information from someplace, and /dev/pts is an obvious place. Ah, maybe if something happens on the screen (/dev/pts/* should be 2-way communications); in that case, the user would be idle, but, because of something going across the device, /dev/pts/0 for example would be updated. – cjc Aug 21 '11 at 15:27
  • That is a likely explanation, and it will defeat my scheme - because I want to shut down idle sessions even if the user is tailing some active log file or using `watch`. – Guss Aug 21 '11 at 16:44