linux日志管理

//有关当前登录用户的信息记录在文件utmp中//登录进入和退出纪录在文件wtmp中[root@bogon python]# who  //who命令查询utmp文件并报告当前登录的每个用户  /var/log/wtmproot     pts/0        2017-06-18 17:54 (192.168.1.100)bp       pts/1        2017-06-18 18:59 (192.168.1.100)[root@bogon python]# usersbp root[root@bogon python]# w  //w命令查询utmp文件并显示当前系统中每个用户和它所运行的进程信息 19:00:50 up  1:07,  2 users,  load average: 0.00, 0.01, 0.05USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHATroot     pts/0    192.168.1.100    17:54    2.00s  0.20s  0.03s wbp       pts/1    192.168.1.100    18:59    1:10   0.06s  0.06s -bash[root@bogon python]# last    //last命令往回搜索wtmp来显示自从文件第一次创建以来登录过的用户，还可以指定单一用户bp       pts/1        192.168.1.100    Sun Jun 18 18:59   still logged in   root     pts/1        192.168.1.100    Sun Jun 18 18:58 - 18:58  (00:00)    root     pts/0        192.168.1.100    Sun Jun 18 17:54   still logged in   reboot   system boot  3.10.0-514.el7.x Sun Jun 18 17:52 - 19:03  (01:10)    root     pts/0        192.168.1.100    Sun Jun 18 01:16 - crash  (16:36)    reboot   system boot  3.10.0-514.el7.x Sun Jun 18 00:53 - 19:03  (18:10)    root     pts/0        192.168.1.100    Fri Jun 16 19:41 - 16:53  (21:11)    root     tty1                          Fri Jun 16 19:36 - 19:35  (23:58)    reboot   system boot  3.10.0-514.el7.x Fri Jun 16 19:36 - 19:35  (23:59)    root     pts/0        192.168.2.1      Thu Jun 15 21:36 - 10:42  (13:06)    root     tty1                          Thu Jun 15 21:35 - 19:35  (21:59)    reboot   system boot  3.10.0-514.el7.x Thu Jun 15 21:34 - 19:35  (22:00)    root     pts/0        192.168.2.1      Sun Apr 30 19:14 - 19:25  (00:11)    root     tty3                          Sun Apr 30 19:09 - 19:25  (00:16)    reboot   system boot  3.10.0-514.el7.x Sun Apr 30 19:08 - 19:25  (00:17)    root     pts/1        192.168.2.1      Sun Apr 30 07:12 - down   (11:56)    root     pts/0        :0               Sun Apr 30 07:08 - 19:08  (11:59)    root     :0           :0               Sun Apr 30 07:08 - 19:08  (11:59)    (unknown :0           :0               Sun Apr 30 07:08 - 07:08  (00:00)    bp       pts/0        :0               Sun Apr 30 07:00 - 07:08  (00:07)    bp       pts/0        :0               Sun Apr 30 06:59 - 06:59  (00:00)    bp       :0           :0               Sun Apr 30 06:55 - 07:08  (00:12)    (unknown :0           :0               Sun Apr 30 06:55 - 06:55  (00:00)    reboot   system boot  3.10.0-514.el7.x Sun Apr 30 02:53 - 19:08  (16:15)    wtmp begins Sun Apr 30 02:53:13 2017[root@bogon python]# ac  //统计累计在线时间    total      118.31[root@bogon python]# ac root    total      117.86[root@bogon python]# ac bp    total        0.45[root@bogon python]# ac -d  //统计每天的Apr 30  total       36.73Jun 15  total        4.80Jun 16  total       39.00Jun 17  total       36.48Today   total        1.33