如何实现动态提取最近24小时的wtmp日志记录？

我现在用这个命令查看指定日期的日志：

utmpdump /var/log/wtmp* | awk '/2022-09-22/, /2022-09-23/'

但这个方法太死板，每次都得手动改日期，有没有办法让脚本自动提取最近24小时的日志？

日志格式示例：

[8] [528314] [    ] [        ] [pts/1       ] [                    ] [0.0.0.0        ] [2022-09-18T18:44:12,422480+00:00]
[8] [476233] [    ] [        ] [pts/0       ] [                    ] [0.0.0.0        ] [2022-09-18T19:25:11,585556+00:00]
[7] [544366] [ts/0] [centos  ] [pts/0       ] [92.46.127.82        ] [92.46.127.82   ] [2022-09-19T04:59:51,304439+00:00]
[8] [544366] [    ] [        ] [pts/0       ] [                    ] [0.0.0.0        ] [2022-09-19T04:59:51,517787+00:00]
[7] [544366] [ts/0] [centos  ] [pts/0       ] [92.46.127.82        ] [92.46.127.82   ] [2022-09-19T04:59:54,121598+00:00]
[8] [544366] [    ] [        ] [pts/0       ] [                    ] [0.0.0.0        ] [2022-09-19T04:59:54,361475+00:00]
[7] [544366] [ts/0] [centos  ] [pts/0       ] [92.46.127.82        ] [92.46.127.82   ] [2022-09-19T04:59:56,613335+00:00]
[8] [544366] [    ] [        ] [pts/0       ] [                    ] [0.0.0.0        ] [2022-09-19T04:59:56,810335+00:00]
[7] [544822] [ts/0] [centos  ] [pts/0       ] [92.46.127.82        ] [92.46.127.82   ] [2022-09-19T05:01:33,299161+00:00]
[8] [544822] [    ] [        ] [pts/0       ] [                    ] [0.0.0.0        ] [2022-09-19T05:01:33,572603+00:00]
[7] [544822] [ts/0] [centos  ] [pts/0       ] [92.46.127.82        ] [92.46.127.82   ] [2022-09-19T05:01:33,897001+00:00]
[8] [544822] [    ] [        ] [pts/0       ] [                    ] [0.0.0.0        ] [2022-09-19T05:01:34,152397+00:00]
[7] [544822] [ts/0] [centos  ] [pts/0       ] [92.46.127.82        ] [92.46.127.82   ] [2022-09-19T05:01:34,438247+00:00]
[8] [544822] [    ] [        ] [pts/0       ] [                    ] [0.0.0.0        ] [2022-09-19T05:01:34,696364+00:00]
[7] [544822] [ts/0] [centos  ] [pts/0       ] [92.46.127.82        ] [92.46.127.82   ] [2022-09-19T05:01:34,978371+00:00]

试试这几种方法：

方法一：用last命令直接过滤（最简单） #

没必要用utmpdump解析原始日志，last命令本身就是处理wtmp的工具，支持直接按时间范围过滤：

last -s "24 hours ago"

如果要包含轮转后的旧日志文件（比如wtmp.1）：

last -f /var/log/wtmp.1 -s "24 hours ago" && last -s "24 hours ago"

这个命令输出格式更友好，直接显示登录用户、终端、来源IP、登录/退出时间，比解析原始数据省心多了。

方法二：awk字符串匹配（兼容性好） #

如果一定要用utmpdump的输出，利用ISO时间字符串的排序特性，直接对比时间字符串就行：

# 生成24小时前的ISO格式时间
START_DATE=$(date -d "24 hours ago" +"%Y-%m-%dT%H:%M:%S")
# 过滤日志中时间晚于该时间的行
utmpdump /var/log/wtmp* | awk -v start="$START_DATE" '{
    # 提取最后一个字段的时间内容，去掉前后的[]
    time_str = substr($NF, 2, length($NF)-2)
    # ISO时间字符串可以直接按字典序对比
    if (time_str >= start) print $0
}'

方法三：awk时间戳对比（精确） #

如果需要更精确的时间对比，可以把日志时间转换成Unix时间戳，和24小时前的时间戳对比：

# 计算24小时前的Unix时间戳
START=$(date -d "24 hours ago" +%s)
utmpdump /var/log/wtmp* | awk -v start="$START" '{
    # 提取时间字段，清理掉无关字符
    time_str = $NF
    gsub(/\[|\]|T|,|\+00:00/, "", time_str)
    # 把YYYYMMDDHHMMSS转换成mktime需要的YYYY MM DD HH MM SS格式
    log_time = mktime(gensub(/([0-9]{4})([0-9]{2})([0-9]{2})([0-9]{2})([0-9]{2})([0-9]{2})/, "\\1 \\2 \\3 \\4 \\5 \\6", 1, time_str))
    # 对比时间戳
    if (log_time >= start) print $0
}'

注意：这个方法依赖GNU awk的mktime和gensub函数，部分系统的awk可能不支持。

内容的提问来源于stack exchange，提问作者Breaking News