linux日志管理

//有关当前登录用户的信息记录在文件utmp中
//登录进入和退出纪录在文件wtmp中
[root@bogon python]# who  //who命令查询utmp文件并报告当前登录的每个用户  /var/log/wtmp
root     pts/0        2017-06-18 17:54 (192.168.1.100)
bp       pts/1        2017-06-18 18:59 (192.168.1.100)
[root@bogon python]# users
bp root
[root@bogon python]# w  //w命令查询utmp文件并显示当前系统中每个用户和它所运行的进程信息
 19:00:50 up  1:07,  2 users,  load average: 0.00, 0.01, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    192.168.1.100    17:54    2.00s  0.20s  0.03s w
bp       pts/1    192.168.1.100    18:59    1:10   0.06s  0.06s -bash
[root@bogon python]# last    //last命令往回搜索wtmp来显示自从文件第一次创建以来登录过的用户，还可以指定单一用户
bp       pts/1        192.168.1.100    Sun Jun 18 18:59   still logged in
root     pts/1        192.168.1.100    Sun Jun 18 18:58 - 18:58  (00:00)
root     pts/0        192.168.1.100    Sun Jun 18 17:54   still logged in
reboot   system boot  3.10.0-514.el7.x Sun Jun 18 17:52 - 19:03  (01:10)
root     pts/0        192.168.1.100    Sun Jun 18 01:16 - crash  (16:36)
reboot   system boot  3.10.0-514.el7.x Sun Jun 18 00:53 - 19:03  (18:10)
root     pts/0        192.168.1.100    Fri Jun 16 19:41 - 16:53  (21:11)
root     tty1                          Fri Jun 16 19:36 - 19:35  (23:58)
reboot   system boot  3.10.0-514.el7.x Fri Jun 16 19:36 - 19:35  (23:59)
root     pts/0        192.168.2.1      Thu Jun 15 21:36 - 10:42  (13:06)
root     tty1                          Thu Jun 15 21:35 - 19:35  (21:59)
reboot   system boot  3.10.0-514.el7.x Thu Jun 15 21:34 - 19:35  (22:00)
root     pts/0        192.168.2.1      Sun Apr 30 19:14 - 19:25  (00:11)
root     tty3                          Sun Apr 30 19:09 - 19:25  (00:16)
reboot   system boot  3.10.0-514.el7.x Sun Apr 30 19:08 - 19:25  (00:17)
root     pts/1        192.168.2.1      Sun Apr 30 07:12 - down   (11:56)
root     pts/0        :0               Sun Apr 30 07:08 - 19:08  (11:59)
root     :0           :0               Sun Apr 30 07:08 - 19:08  (11:59)
(unknown :0           :0               Sun Apr 30 07:08 - 07:08  (00:00)
bp       pts/0        :0               Sun Apr 30 07:00 - 07:08  (00:07)
bp       pts/0        :0               Sun Apr 30 06:59 - 06:59  (00:00)
bp       :0           :0               Sun Apr 30 06:55 - 07:08  (00:12)
(unknown :0           :0               Sun Apr 30 06:55 - 06:55  (00:00)
reboot   system boot  3.10.0-514.el7.x Sun Apr 30 02:53 - 19:08  (16:15)    

wtmp begins Sun Apr 30 02:53:13 2017
[root@bogon python]# ac  //统计累计在线时间
    total      118.31
[root@bogon python]# ac root
    total      117.86
[root@bogon python]# ac bp
    total        0.45
[root@bogon python]# ac -d  //统计每天的
Apr 30  total       36.73
Jun 15  total        4.80
Jun 16  total       39.00
Jun 17  total       36.48
Today   total        1.33