]>
Commit | Line | Data |
---|---|---|
a74aeac6 PR |
1 | /* |
2 | * last.c Re-implementation of the 'last' command, this time | |
3 | * for Linux. Yes I know there is BSD last, but I | |
4 | * just felt like writing this. No thanks :-). | |
5 | * Also, this version gives lots more info (especially with -x) | |
6 | * | |
7 | * Author: Miquel van Smoorenburg, miquels@cistron.nl | |
8 | * | |
9 | * Version: @(#)last 2.85 30-Jul-2004 miquels@cistron.nl | |
10 | * | |
11 | * This file is part of the sysvinit suite, | |
12 | * Copyright (C) 1991-2004 Miquel van Smoorenburg. | |
13 | * | |
14 | * This program is free software; you can redistribute it and/or modify | |
15 | * it under the terms of the GNU General Public License as published by | |
16 | * the Free Software Foundation; either version 2 of the License, or | |
17 | * (at your option) any later version. | |
18 | * | |
19 | * This program is distributed in the hope that it will be useful, | |
20 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
21 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
22 | * GNU General Public License for more details. | |
23 | * | |
24 | * You should have received a copy of the GNU General Public License | |
25 | * along with this program; if not, write to the Free Software | |
26 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA | |
27 | */ | |
28 | ||
29 | #include <sys/types.h> | |
30 | #include <sys/stat.h> | |
31 | #include <sys/fcntl.h> | |
32 | #include <time.h> | |
33 | #include <stdio.h> | |
34 | #include <ctype.h> | |
35 | #include <utmp.h> | |
36 | #include <errno.h> | |
37 | #include <malloc.h> | |
38 | #include <stdlib.h> | |
39 | #include <unistd.h> | |
40 | #include <string.h> | |
41 | #include <signal.h> | |
42 | #include <getopt.h> | |
43 | #include <netinet/in.h> | |
44 | #include <netdb.h> | |
45 | #include <arpa/inet.h> | |
46 | #include "oldutmp.h" | |
47 | ||
48 | #ifndef SHUTDOWN_TIME | |
49 | # define SHUTDOWN_TIME 254 | |
50 | #endif | |
51 | ||
52 | char *Version = "@(#) last 2.85 31-Apr-2004 miquels"; | |
53 | ||
54 | #define CHOP_DOMAIN 0 /* Define to chop off local domainname. */ | |
55 | #define NEW_UTMP 1 /* Fancy & fast utmp read code. */ | |
56 | #define UCHUNKSIZE 16384 /* How much we read at once. */ | |
57 | ||
58 | /* Double linked list of struct utmp's */ | |
59 | struct utmplist { | |
60 | struct utmp ut; | |
61 | struct utmplist *next; | |
62 | struct utmplist *prev; | |
63 | }; | |
64 | struct utmplist *utmplist = NULL; | |
65 | ||
66 | /* Types of listing */ | |
67 | #define R_CRASH 1 /* No logout record, system boot in between */ | |
68 | #define R_DOWN 2 /* System brought down in decent way */ | |
69 | #define R_NORMAL 3 /* Normal */ | |
70 | #define R_NOW 4 /* Still logged in */ | |
71 | #define R_REBOOT 5 /* Reboot record. */ | |
72 | #define R_PHANTOM 6 /* No logout record but session is stale. */ | |
73 | #define R_TIMECHANGE 7 /* NEW_TIME or OLD_TIME */ | |
74 | ||
75 | /* Global variables */ | |
76 | int maxrecs = 0; /* Maximum number of records to list. */ | |
77 | int recsdone = 0; /* Number of records listed */ | |
78 | int showhost = 1; /* Show hostname too? */ | |
79 | int altlist = 0; /* Show hostname at the end. */ | |
80 | int usedns = 0; /* Use DNS to lookup the hostname. */ | |
81 | int useip = 0; /* Print IP address in number format */ | |
82 | int fulltime = 0; /* Print full dates and times */ | |
1414572e DWF |
83 | int name_len = 8; /* Default print 8 characters of name */ |
84 | int domain_len = 16; /* Default print 16 characters of domain */ | |
a74aeac6 PR |
85 | int oldfmt = 0; /* Use old libc5 format? */ |
86 | char **show = NULL; /* What do they want us to show */ | |
87 | char *ufile; /* Filename of this file */ | |
88 | time_t lastdate; /* Last date we've seen */ | |
89 | char *progname; /* Name of this program */ | |
90 | #if CHOP_DOMAIN | |
91 | char hostname[256]; /* For gethostbyname() */ | |
92 | char *domainname; /* Our domainname. */ | |
93 | #endif | |
94 | ||
95 | /* | |
96 | * Convert old utmp format to new. | |
97 | */ | |
98 | void uconv(struct oldutmp *oldut, struct utmp *utn) | |
99 | { | |
100 | memset(utn, 0, sizeof(struct utmp)); | |
101 | utn->ut_type = oldut->ut_type; | |
102 | utn->ut_pid = oldut->ut_pid; | |
103 | utn->ut_time = oldut->ut_oldtime; | |
104 | utn->ut_addr = oldut->ut_oldaddr; | |
105 | strncpy(utn->ut_line, oldut->ut_line, OLD_LINESIZE); | |
106 | strncpy(utn->ut_user, oldut->ut_user, OLD_NAMESIZE); | |
107 | strncpy(utn->ut_host, oldut->ut_host, OLD_HOSTSIZE); | |
108 | } | |
109 | ||
110 | #if NEW_UTMP | |
111 | /* | |
112 | * Read one utmp entry, return in new format. | |
113 | * Automatically reposition file pointer. | |
114 | */ | |
115 | int uread(FILE *fp, struct utmp *u, int *quit) | |
116 | { | |
117 | static int utsize; | |
118 | static char buf[UCHUNKSIZE]; | |
119 | char tmp[1024]; | |
120 | static off_t fpos; | |
121 | static int bpos; | |
122 | struct oldutmp uto; | |
123 | int r; | |
124 | off_t o; | |
125 | ||
126 | if (quit == NULL && u != NULL) { | |
127 | /* | |
128 | * Normal read. | |
129 | */ | |
130 | if (oldfmt) { | |
131 | r = fread(&uto, sizeof(uto), 1, fp); | |
132 | uconv(&uto, u); | |
133 | } else | |
134 | r = fread(u, sizeof(struct utmp), 1, fp); | |
135 | return r; | |
136 | } | |
137 | ||
138 | if (u == NULL) { | |
139 | /* | |
140 | * Initialize and position. | |
141 | */ | |
142 | utsize = oldfmt ? sizeof(uto) : sizeof(struct utmp); | |
143 | fseeko(fp, 0, SEEK_END); | |
144 | fpos = ftello(fp); | |
145 | if (fpos == 0) | |
146 | return 0; | |
147 | o = ((fpos - 1) / UCHUNKSIZE) * UCHUNKSIZE; | |
148 | if (fseeko(fp, o, SEEK_SET) < 0) { | |
149 | fprintf(stderr, "%s: seek failed!\n", progname); | |
150 | return 0; | |
151 | } | |
152 | bpos = (int)(fpos - o); | |
153 | if (fread(buf, bpos, 1, fp) != 1) { | |
154 | fprintf(stderr, "%s: read failed!\n", progname); | |
155 | return 0; | |
156 | } | |
157 | fpos = o; | |
158 | return 1; | |
159 | } | |
160 | ||
161 | /* | |
162 | * Read one struct. From the buffer if possible. | |
163 | */ | |
164 | bpos -= utsize; | |
165 | if (bpos >= 0) { | |
166 | if (oldfmt) | |
167 | uconv((struct oldutmp *)(buf + bpos), u); | |
168 | else | |
169 | memcpy(u, buf + bpos, sizeof(struct utmp)); | |
170 | return 1; | |
171 | } | |
172 | ||
173 | /* | |
174 | * Oops we went "below" the buffer. We should be able to | |
175 | * seek back UCHUNKSIZE bytes. | |
176 | */ | |
177 | fpos -= UCHUNKSIZE; | |
178 | if (fpos < 0) | |
179 | return 0; | |
180 | ||
181 | /* | |
182 | * Copy whatever is left in the buffer. | |
183 | */ | |
184 | memcpy(tmp + (-bpos), buf, utsize + bpos); | |
185 | if (fseeko(fp, fpos, SEEK_SET) < 0) { | |
186 | perror("fseek"); | |
187 | return 0; | |
188 | } | |
189 | ||
190 | /* | |
191 | * Read another UCHUNKSIZE bytes. | |
192 | */ | |
193 | if (fread(buf, UCHUNKSIZE, 1, fp) != 1) { | |
194 | perror("fread"); | |
195 | return 0; | |
196 | } | |
197 | ||
198 | /* | |
199 | * The end of the UCHUNKSIZE byte buffer should be the first | |
200 | * few bytes of the current struct utmp. | |
201 | */ | |
202 | memcpy(tmp, buf + UCHUNKSIZE + bpos, -bpos); | |
203 | bpos += UCHUNKSIZE; | |
204 | ||
205 | if (oldfmt) | |
206 | uconv((struct oldutmp *)tmp, u); | |
207 | else | |
208 | memcpy(u, tmp, sizeof(struct utmp)); | |
209 | ||
210 | return 1; | |
211 | } | |
212 | ||
213 | #else /* NEW_UTMP */ | |
214 | ||
215 | /* | |
216 | * Read one utmp entry, return in new format. | |
217 | * Automatically reposition file pointer. | |
218 | */ | |
219 | int uread(FILE *fp, struct utmp *u, int *quit) | |
220 | { | |
221 | struct oldutmp uto; | |
222 | off_t r; | |
223 | ||
224 | if (u == NULL) { | |
225 | r = oldfmt ? sizeof(struct oldutmp) : sizeof(struct utmp); | |
226 | fseek(fp, -1 * r, SEEK_END); | |
227 | return 1; | |
228 | } | |
229 | ||
230 | if (!oldfmt) { | |
231 | r = fread(u, sizeof(struct utmp), 1, fp); | |
232 | if (r == 1) { | |
233 | if (fseeko(fp, -2 * sizeof(struct utmp), SEEK_CUR) < 0) | |
234 | if (quit) *quit = 1; | |
235 | } | |
236 | return r; | |
237 | } | |
238 | r = fread(&uto, sizeof(struct oldutmp), 1, fp); | |
239 | if (r == 1) { | |
240 | if (fseeko(fp, -2 * sizeof(struct oldutmp), SEEK_CUR) < 0) | |
241 | if (quit) *quit = 1; | |
242 | uconv(&uto, u); | |
243 | } | |
244 | ||
245 | return r; | |
246 | } | |
247 | #endif | |
248 | ||
249 | /* | |
250 | * Try to be smart about the location of the BTMP file | |
251 | */ | |
252 | #ifndef BTMP_FILE | |
253 | #define BTMP_FILE getbtmp() | |
254 | char *getbtmp() | |
255 | { | |
256 | static char btmp[128]; | |
257 | char *p; | |
258 | ||
259 | strcpy(btmp, WTMP_FILE); | |
260 | if ((p = strrchr(btmp, '/')) == NULL) | |
261 | p = btmp; | |
262 | else | |
263 | p++; | |
264 | *p = 0; | |
265 | strcat(btmp, "btmp"); | |
266 | return btmp; | |
267 | } | |
268 | #endif | |
269 | ||
270 | /* | |
271 | * Print a short date. | |
272 | */ | |
273 | char *showdate() | |
274 | { | |
275 | char *s = ctime(&lastdate); | |
276 | s[16] = 0; | |
277 | return s; | |
278 | } | |
279 | ||
280 | /* | |
281 | * SIGINT handler | |
282 | */ | |
283 | void int_handler() | |
284 | { | |
285 | printf("Interrupted %s\n", showdate()); | |
286 | exit(1); | |
287 | } | |
288 | ||
289 | /* | |
290 | * SIGQUIT handler | |
291 | */ | |
292 | void quit_handler() | |
293 | { | |
294 | printf("Interrupted %s\n", showdate()); | |
295 | signal(SIGQUIT, quit_handler); | |
296 | } | |
297 | ||
298 | /* | |
299 | * Get the basename of a filename | |
300 | */ | |
301 | char *mybasename(char *s) | |
302 | { | |
303 | char *p; | |
304 | ||
305 | if ((p = strrchr(s, '/')) != NULL) | |
306 | p++; | |
307 | else | |
308 | p = s; | |
309 | return p; | |
310 | } | |
311 | ||
312 | /* | |
313 | * Lookup a host with DNS. | |
314 | */ | |
315 | int dns_lookup(char *result, int size, int useip, int32_t *a) | |
316 | { | |
317 | struct sockaddr_in sin; | |
318 | struct sockaddr_in6 sin6; | |
319 | struct sockaddr *sa; | |
320 | int salen, flags; | |
321 | unsigned int topnibble; | |
322 | unsigned int azero = 0, sitelocal = 0; | |
323 | int mapped = 0; | |
324 | ||
325 | flags = useip ? NI_NUMERICHOST : 0; | |
326 | ||
327 | /* | |
328 | * IPv4 or IPv6 ? We use 2 heuristics: | |
329 | * 1. Current IPv6 range uses 2000-3fff or fec0-feff. | |
330 | * Outside of that is illegal and must be IPv4. | |
331 | * 2. If last 3 bytes are 0, must be IPv4 | |
332 | * 3. If IPv6 in IPv4, handle as IPv4 | |
333 | * | |
334 | * Ugly. | |
335 | */ | |
192c4567 | 336 | if (a[0] == 0 && a[1] == 0 && a[2] == (int32_t)htonl (0xffff)) |
a74aeac6 PR |
337 | mapped = 1; |
338 | topnibble = ntohl((unsigned int)a[0]) >> 28; | |
339 | ||
340 | azero = ntohl((unsigned int)a[0]) >> 16; | |
341 | sitelocal = (azero >= 0xfec0 && azero <= 0xfeff) ? 1 : 0; | |
342 | ||
343 | if (((topnibble < 2 || topnibble > 3) && (!sitelocal)) || mapped || | |
344 | (a[1] == 0 && a[2] == 0 && a[3] == 0)) { | |
345 | /* IPv4 */ | |
346 | sin.sin_family = AF_INET; | |
347 | sin.sin_port = 0; | |
348 | sin.sin_addr.s_addr = mapped ? a[3] : a[0]; | |
349 | sa = (struct sockaddr *)&sin; | |
350 | salen = sizeof(sin); | |
351 | } else { | |
352 | /* IPv6 */ | |
353 | memset(&sin6, 0, sizeof(sin6)); | |
354 | sin6.sin6_family = AF_INET6; | |
355 | sin6.sin6_port = 0; | |
356 | memcpy(sin6.sin6_addr.s6_addr, a, 16); | |
357 | sa = (struct sockaddr *)&sin6; | |
358 | salen = sizeof(sin6); | |
359 | } | |
360 | ||
361 | return getnameinfo(sa, salen, result, size, NULL, 0, flags); | |
362 | } | |
363 | ||
364 | /* | |
365 | * Show one line of information on screen | |
366 | */ | |
367 | int list(struct utmp *p, time_t t, int what) | |
368 | { | |
369 | time_t secs, tmp; | |
370 | char logintime[32]; | |
371 | char logouttime[32]; | |
372 | char length[32]; | |
1414572e | 373 | char final[512]; |
a74aeac6 PR |
374 | char utline[UT_LINESIZE+1]; |
375 | char domain[256]; | |
376 | char *s, **walk; | |
377 | int mins, hours, days; | |
378 | int r, len; | |
379 | ||
380 | /* | |
381 | * uucp and ftp have special-type entries | |
382 | */ | |
383 | utline[0] = 0; | |
384 | strncat(utline, p->ut_line, UT_LINESIZE); | |
385 | if (strncmp(utline, "ftp", 3) == 0 && isdigit(utline[3])) | |
386 | utline[3] = 0; | |
387 | if (strncmp(utline, "uucp", 4) == 0 && isdigit(utline[4])) | |
388 | utline[4] = 0; | |
389 | ||
390 | /* | |
391 | * Is this something we wanna show? | |
392 | */ | |
393 | if (show) { | |
394 | for (walk = show; *walk; walk++) { | |
395 | if (strncmp(p->ut_name, *walk, UT_NAMESIZE) == 0 || | |
396 | strcmp(utline, *walk) == 0 || | |
397 | (strncmp(utline, "tty", 3) == 0 && | |
398 | strcmp(utline + 3, *walk) == 0)) break; | |
399 | } | |
400 | if (*walk == NULL) return 0; | |
401 | } | |
402 | ||
403 | /* | |
404 | * Calculate times | |
405 | */ | |
406 | tmp = (time_t)p->ut_time; | |
407 | strcpy(logintime, ctime(&tmp)); | |
408 | if (fulltime) | |
409 | sprintf(logouttime, "- %s", ctime(&t)); | |
410 | else { | |
411 | logintime[16] = 0; | |
412 | sprintf(logouttime, "- %s", ctime(&t) + 11); | |
413 | logouttime[7] = 0; | |
414 | } | |
415 | secs = t - p->ut_time; | |
416 | mins = (secs / 60) % 60; | |
417 | hours = (secs / 3600) % 24; | |
418 | days = secs / 86400; | |
419 | if (days) | |
420 | sprintf(length, "(%d+%02d:%02d)", days, hours, mins); | |
421 | else | |
422 | sprintf(length, " (%02d:%02d)", hours, mins); | |
423 | ||
424 | switch(what) { | |
425 | case R_CRASH: | |
426 | sprintf(logouttime, "- crash"); | |
427 | break; | |
428 | case R_DOWN: | |
429 | sprintf(logouttime, "- down "); | |
430 | break; | |
431 | case R_NOW: | |
432 | length[0] = 0; | |
433 | if (fulltime) | |
434 | sprintf(logouttime, " still logged in"); | |
435 | else { | |
436 | sprintf(logouttime, " still"); | |
437 | sprintf(length, "logged in"); | |
438 | } | |
439 | break; | |
440 | case R_PHANTOM: | |
441 | length[0] = 0; | |
442 | if (fulltime) | |
443 | sprintf(logouttime, " gone - no logout"); | |
444 | else { | |
445 | sprintf(logouttime, " gone"); | |
446 | sprintf(length, "- no logout"); | |
447 | } | |
448 | break; | |
449 | case R_REBOOT: | |
450 | break; | |
451 | case R_TIMECHANGE: | |
452 | logouttime[0] = 0; | |
453 | length[0] = 0; | |
454 | break; | |
455 | case R_NORMAL: | |
456 | break; | |
457 | } | |
458 | ||
459 | /* | |
460 | * Look up host with DNS if needed. | |
461 | */ | |
462 | r = -1; | |
463 | if (usedns || useip) | |
464 | r = dns_lookup(domain, sizeof(domain), useip, p->ut_addr_v6); | |
465 | if (r < 0) { | |
466 | len = UT_HOSTSIZE; | |
192c4567 | 467 | if (len >= (int)sizeof(domain)) len = sizeof(domain) - 1; |
a74aeac6 PR |
468 | domain[0] = 0; |
469 | strncat(domain, p->ut_host, len); | |
470 | } | |
471 | ||
472 | if (showhost) { | |
473 | #if CHOP_DOMAIN | |
474 | /* | |
475 | * See if this is in our domain. | |
476 | */ | |
477 | if (!usedns && (s = strchr(p->ut_host, '.')) != NULL && | |
478 | strcmp(s + 1, domainname) == 0) *s = 0; | |
479 | #endif | |
480 | if (!altlist) { | |
63a2c981 | 481 | len = snprintf(final, sizeof(final), |
a74aeac6 | 482 | fulltime ? |
1414572e DWF |
483 | "%-8.*s %-12.12s %-16.*s %-24.24s %-26.26s %-12.12s\n" : |
484 | "%-8.*s %-12.12s %-16.*s %-16.16s %-7.7s %-12.12s\n", | |
485 | name_len, p->ut_name, utline, | |
486 | domain_len, domain, logintime, logouttime, length); | |
a74aeac6 | 487 | } else { |
63a2c981 | 488 | len = snprintf(final, sizeof(final), |
a74aeac6 | 489 | fulltime ? |
1414572e DWF |
490 | "%-8.*s %-12.12s %-24.24s %-26.26s %-12.12s %s\n" : |
491 | "%-8.*s %-12.12s %-16.16s %-7.7s %-12.12s %s\n", | |
492 | name_len, p->ut_name, utline, | |
a74aeac6 PR |
493 | logintime, logouttime, length, domain); |
494 | } | |
495 | } else | |
63a2c981 | 496 | len = snprintf(final, sizeof(final), |
a74aeac6 | 497 | fulltime ? |
1414572e DWF |
498 | "%-8.*s %-12.12s %-24.24s %-26.26s %-12.12s\n" : |
499 | "%-8.*s %-12.12s %-16.16s %-7.7s %-12.12s\n", | |
500 | name_len, p->ut_name, utline, | |
a74aeac6 PR |
501 | logintime, logouttime, length); |
502 | ||
63a2c981 DWF |
503 | #if defined(__GLIBC__) |
504 | # if (__GLIBC__ == 2) && (__GLIBC_MINOR__ == 0) | |
505 | final[sizeof(final)-1] = '\0'; | |
506 | # endif | |
507 | #endif | |
508 | ||
a74aeac6 PR |
509 | /* |
510 | * Print out "final" string safely. | |
511 | */ | |
512 | for (s = final; *s; s++) { | |
513 | if (*s == '\n' || (*s >= 32 && (unsigned char)*s <= 126)) | |
514 | putchar(*s); | |
515 | else | |
516 | putchar('*'); | |
517 | } | |
518 | ||
1414572e | 519 | if (len < 0 || (size_t)len >= sizeof(final)) |
63a2c981 DWF |
520 | putchar('\n'); |
521 | ||
a74aeac6 PR |
522 | recsdone++; |
523 | if (maxrecs && recsdone >= maxrecs) | |
524 | return 1; | |
525 | ||
526 | return 0; | |
527 | } | |
528 | ||
529 | ||
530 | /* | |
531 | * show usage | |
532 | */ | |
533 | void usage(char *s) | |
534 | { | |
535 | fprintf(stderr, "Usage: %s [-num | -n num] [-f file] " | |
536 | "[-t YYYYMMDDHHMMSS] " | |
1414572e | 537 | "[-R] [-adioxFw] [username..] [tty..]\n", s); |
a74aeac6 PR |
538 | exit(1); |
539 | } | |
540 | ||
541 | time_t parsetm(char *ts) | |
542 | { | |
543 | struct tm u, origu; | |
544 | time_t tm; | |
545 | ||
546 | memset(&tm, 0, sizeof(tm)); | |
547 | ||
548 | if (sscanf(ts, "%4d%2d%2d%2d%2d%2d", &u.tm_year, | |
549 | &u.tm_mon, &u.tm_mday, &u.tm_hour, &u.tm_min, | |
550 | &u.tm_sec) != 6) | |
551 | return (time_t)-1; | |
552 | ||
553 | u.tm_year -= 1900; | |
554 | u.tm_mon -= 1; | |
555 | u.tm_isdst = -1; | |
556 | ||
557 | origu = u; | |
558 | ||
559 | if ((tm = mktime(&u)) == (time_t)-1) | |
560 | return tm; | |
561 | ||
562 | /* | |
563 | * Unfortunately mktime() is much more forgiving than | |
564 | * it should be. For example, it'll gladly accept | |
565 | * "30" as a valid month number. This behavior is by | |
566 | * design, but we don't like it, so we want to detect | |
567 | * it and complain. | |
568 | */ | |
569 | if (u.tm_year != origu.tm_year || | |
570 | u.tm_mon != origu.tm_mon || | |
571 | u.tm_mday != origu.tm_mday || | |
572 | u.tm_hour != origu.tm_hour || | |
573 | u.tm_min != origu.tm_min || | |
574 | u.tm_sec != origu.tm_sec) | |
575 | return (time_t)-1; | |
576 | ||
577 | return tm; | |
578 | } | |
579 | ||
580 | int main(int argc, char **argv) | |
581 | { | |
582 | FILE *fp; /* Filepointer of wtmp file */ | |
583 | ||
584 | struct utmp ut; /* Current utmp entry */ | |
585 | struct utmp oldut; /* Old utmp entry to check for duplicates */ | |
586 | struct utmplist *p; /* Pointer into utmplist */ | |
587 | struct utmplist *next;/* Pointer into utmplist */ | |
588 | ||
589 | time_t lastboot = 0; /* Last boottime */ | |
590 | time_t lastrch = 0; /* Last run level change */ | |
591 | time_t lastdown; /* Last downtime */ | |
592 | time_t begintime; /* When wtmp begins */ | |
593 | int whydown = 0; /* Why we went down: crash or shutdown */ | |
594 | ||
595 | int c, x; /* Scratch */ | |
596 | struct stat st; /* To stat the [uw]tmp file */ | |
597 | int quit = 0; /* Flag */ | |
598 | int down = 0; /* Down flag */ | |
599 | int lastb = 0; /* Is this 'lastb' ? */ | |
600 | int extended = 0; /* Lots of info. */ | |
601 | char *altufile = NULL;/* Alternate wtmp */ | |
602 | ||
603 | time_t until = 0; /* at what time to stop parsing the file */ | |
604 | ||
605 | progname = mybasename(argv[0]); | |
606 | ||
607 | /* Process the arguments. */ | |
1414572e | 608 | while((c = getopt(argc, argv, "f:n:RxadFiot:0123456789w")) != EOF) |
a74aeac6 PR |
609 | switch(c) { |
610 | case 'R': | |
611 | showhost = 0; | |
612 | break; | |
613 | case 'x': | |
614 | extended = 1; | |
615 | break; | |
616 | case 'n': | |
617 | maxrecs = atoi(optarg); | |
618 | break; | |
619 | case 'o': | |
620 | oldfmt = 1; | |
621 | break; | |
622 | case 'f': | |
623 | if((altufile = malloc(strlen(optarg)+1)) == NULL) { | |
624 | fprintf(stderr, "%s: out of memory\n", | |
625 | progname); | |
626 | exit(1); | |
627 | } | |
628 | strcpy(altufile, optarg); | |
629 | break; | |
630 | case 'd': | |
631 | usedns++; | |
632 | break; | |
633 | case 'i': | |
634 | useip++; | |
635 | break; | |
636 | case 'a': | |
637 | altlist++; | |
638 | break; | |
639 | case 'F': | |
640 | fulltime++; | |
641 | break; | |
642 | case 't': | |
643 | if ((until = parsetm(optarg)) == (time_t)-1) { | |
644 | fprintf(stderr, "%s: Invalid time value \"%s\"\n", | |
645 | progname, optarg); | |
646 | usage(progname); | |
647 | } | |
648 | break; | |
1414572e DWF |
649 | case 'w': |
650 | if (UT_NAMESIZE > name_len) | |
651 | name_len = UT_NAMESIZE; | |
652 | if (UT_HOSTSIZE > domain_len) | |
653 | domain_len = UT_HOSTSIZE; | |
654 | break; | |
a74aeac6 PR |
655 | case '0': case '1': case '2': case '3': case '4': |
656 | case '5': case '6': case '7': case '8': case '9': | |
657 | maxrecs = 10*maxrecs + c - '0'; | |
658 | break; | |
659 | default: | |
660 | usage(progname); | |
661 | break; | |
662 | } | |
663 | if (optind < argc) show = argv + optind; | |
664 | ||
665 | /* | |
666 | * Which file do we want to read? | |
667 | */ | |
668 | if (strcmp(progname, "lastb") == 0) { | |
669 | ufile = BTMP_FILE; | |
670 | lastb = 1; | |
671 | } else | |
672 | ufile = WTMP_FILE; | |
673 | if (altufile) | |
674 | ufile = altufile; | |
675 | time(&lastdown); | |
676 | lastrch = lastdown; | |
677 | ||
678 | /* | |
679 | * Fill in 'lastdate' | |
680 | */ | |
681 | lastdate = lastdown; | |
682 | ||
683 | #if CHOP_DOMAIN | |
684 | /* | |
685 | * Find out domainname. | |
686 | * | |
687 | * This doesn't work on modern systems, where only a DNS | |
688 | * lookup of the result from hostname() will get you the domainname. | |
689 | * Remember that domainname() is the NIS domainname, not DNS. | |
690 | * So basically this whole piece of code is bullshit. | |
691 | */ | |
692 | hostname[0] = 0; | |
693 | (void) gethostname(hostname, sizeof(hostname)); | |
694 | if ((domainname = strchr(hostname, '.')) != NULL) domainname++; | |
695 | if (domainname == NULL || domainname[0] == 0) { | |
696 | hostname[0] = 0; | |
697 | (void) getdomainname(hostname, sizeof(hostname)); | |
698 | hostname[sizeof(hostname) - 1] = 0; | |
699 | domainname = hostname; | |
700 | if (strcmp(domainname, "(none)") == 0 || domainname[0] == 0) | |
701 | domainname = NULL; | |
702 | } | |
703 | #endif | |
704 | ||
705 | /* | |
706 | * Install signal handlers | |
707 | */ | |
708 | signal(SIGINT, int_handler); | |
709 | signal(SIGQUIT, quit_handler); | |
710 | ||
711 | /* | |
712 | * Open the utmp file | |
713 | */ | |
714 | if ((fp = fopen(ufile, "r")) == NULL) { | |
715 | x = errno; | |
716 | fprintf(stderr, "%s: %s: %s\n", progname, ufile, strerror(errno)); | |
717 | if (altufile == NULL && x == ENOENT) | |
718 | fprintf(stderr, "Perhaps this file was removed by the " | |
719 | "operator to prevent logging %s info.\n", progname); | |
720 | exit(1); | |
721 | } | |
722 | ||
723 | /* | |
724 | * Optimize the buffer size. | |
725 | */ | |
726 | setvbuf(fp, NULL, _IOFBF, UCHUNKSIZE); | |
727 | ||
728 | /* | |
729 | * Read first structure to capture the time field | |
730 | */ | |
731 | if (uread(fp, &ut, NULL) == 1) | |
732 | begintime = ut.ut_time; | |
733 | else { | |
734 | fstat(fileno(fp), &st); | |
735 | begintime = st.st_ctime; | |
736 | quit = 1; | |
737 | } | |
738 | ||
739 | /* | |
740 | * Go to end of file minus one structure | |
741 | * and/or initialize utmp reading code. | |
742 | */ | |
743 | uread(fp, NULL, NULL); | |
744 | ||
745 | /* | |
746 | * Read struct after struct backwards from the file. | |
747 | */ | |
748 | while(!quit) { | |
749 | ||
750 | if (uread(fp, &ut, &quit) != 1) | |
751 | break; | |
752 | ||
753 | if (until && until < ut.ut_time) | |
754 | continue; | |
755 | ||
756 | if (memcmp(&ut, &oldut, sizeof(struct utmp)) == 0) continue; | |
757 | memcpy(&oldut, &ut, sizeof(struct utmp)); | |
758 | lastdate = ut.ut_time; | |
759 | ||
760 | if (lastb) { | |
761 | quit = list(&ut, ut.ut_time, R_NORMAL); | |
762 | continue; | |
763 | } | |
764 | ||
765 | /* | |
766 | * Set ut_type to the correct type. | |
767 | */ | |
768 | if (strncmp(ut.ut_line, "~", 1) == 0) { | |
769 | if (strncmp(ut.ut_user, "shutdown", 8) == 0) | |
770 | ut.ut_type = SHUTDOWN_TIME; | |
771 | else if (strncmp(ut.ut_user, "reboot", 6) == 0) | |
772 | ut.ut_type = BOOT_TIME; | |
773 | else if (strncmp(ut.ut_user, "runlevel", 8) == 0) | |
774 | ut.ut_type = RUN_LVL; | |
775 | } | |
776 | #if 1 /*def COMPAT*/ | |
777 | /* | |
778 | * For stupid old applications that don't fill in | |
779 | * ut_type correctly. | |
780 | */ | |
781 | else { | |
782 | if (ut.ut_type != DEAD_PROCESS && | |
783 | ut.ut_name[0] && ut.ut_line[0] && | |
784 | strcmp(ut.ut_name, "LOGIN") != 0) | |
785 | ut.ut_type = USER_PROCESS; | |
786 | /* | |
787 | * Even worse, applications that write ghost | |
788 | * entries: ut_type set to USER_PROCESS but | |
789 | * empty ut_name... | |
790 | */ | |
791 | if (ut.ut_name[0] == 0) | |
792 | ut.ut_type = DEAD_PROCESS; | |
793 | ||
794 | /* | |
795 | * Clock changes. | |
796 | */ | |
797 | if (strcmp(ut.ut_name, "date") == 0) { | |
798 | if (ut.ut_line[0] == '|') ut.ut_type = OLD_TIME; | |
799 | if (ut.ut_line[0] == '{') ut.ut_type = NEW_TIME; | |
800 | } | |
801 | } | |
802 | #endif | |
803 | ||
804 | switch (ut.ut_type) { | |
805 | case SHUTDOWN_TIME: | |
806 | if (extended) { | |
807 | strcpy(ut.ut_line, "system down"); | |
808 | quit = list(&ut, lastboot, R_NORMAL); | |
809 | } | |
810 | lastdown = lastrch = ut.ut_time; | |
811 | down = 1; | |
812 | break; | |
813 | case OLD_TIME: | |
814 | case NEW_TIME: | |
815 | if (extended) { | |
816 | strcpy(ut.ut_line, | |
817 | ut.ut_type == NEW_TIME ? "new time" : | |
818 | "old time"); | |
819 | quit = list(&ut, lastdown, R_TIMECHANGE); | |
820 | } | |
821 | break; | |
822 | case BOOT_TIME: | |
823 | strcpy(ut.ut_line, "system boot"); | |
824 | quit = list(&ut, lastdown, R_REBOOT); | |
825 | lastboot = ut.ut_time; | |
826 | down = 1; | |
827 | break; | |
828 | case RUN_LVL: | |
829 | x = ut.ut_pid & 255; | |
830 | if (extended) { | |
831 | sprintf(ut.ut_line, "(to lvl %c)", x); | |
832 | quit = list(&ut, lastrch, R_NORMAL); | |
833 | } | |
834 | if (x == '0' || x == '6') { | |
835 | lastdown = ut.ut_time; | |
836 | down = 1; | |
837 | ut.ut_type = SHUTDOWN_TIME; | |
838 | } | |
839 | lastrch = ut.ut_time; | |
840 | break; | |
841 | ||
842 | case USER_PROCESS: | |
843 | /* | |
844 | * This was a login - show the first matching | |
845 | * logout record and delete all records with | |
846 | * the same ut_line. | |
847 | */ | |
848 | c = 0; | |
849 | for (p = utmplist; p; p = next) { | |
850 | next = p->next; | |
851 | if (strncmp(p->ut.ut_line, ut.ut_line, | |
852 | UT_LINESIZE) == 0) { | |
853 | /* Show it */ | |
854 | if (c == 0) { | |
855 | quit = list(&ut, p->ut.ut_time, | |
856 | R_NORMAL); | |
857 | c = 1; | |
858 | } | |
859 | if (p->next) p->next->prev = p->prev; | |
860 | if (p->prev) | |
861 | p->prev->next = p->next; | |
862 | else | |
863 | utmplist = p->next; | |
864 | free(p); | |
865 | } | |
866 | } | |
867 | /* | |
868 | * Not found? Then crashed, down, still | |
869 | * logged in, or missing logout record. | |
870 | */ | |
871 | if (c == 0) { | |
872 | if (lastboot == 0) { | |
873 | c = R_NOW; | |
874 | /* Is process still alive? */ | |
875 | if (ut.ut_pid > 0 && | |
876 | kill(ut.ut_pid, 0) != 0 && | |
877 | errno == ESRCH) | |
878 | c = R_PHANTOM; | |
879 | } else | |
880 | c = whydown; | |
881 | quit = list(&ut, lastboot, c); | |
882 | } | |
883 | /* FALLTHRU */ | |
884 | ||
885 | case DEAD_PROCESS: | |
886 | /* | |
887 | * Just store the data if it is | |
888 | * interesting enough. | |
889 | */ | |
890 | if (ut.ut_line[0] == 0) | |
891 | break; | |
892 | if ((p = malloc(sizeof(struct utmplist))) == NULL) { | |
893 | fprintf(stderr, "%s: out of memory\n", | |
894 | progname); | |
895 | exit(1); | |
896 | } | |
897 | memcpy(&p->ut, &ut, sizeof(struct utmp)); | |
898 | p->next = utmplist; | |
899 | p->prev = NULL; | |
900 | if (utmplist) utmplist->prev = p; | |
901 | utmplist = p; | |
902 | break; | |
903 | ||
904 | } | |
905 | /* | |
906 | * If we saw a shutdown/reboot record we can remove | |
907 | * the entire current utmplist. | |
908 | */ | |
909 | if (down) { | |
910 | lastboot = ut.ut_time; | |
911 | whydown = (ut.ut_type == SHUTDOWN_TIME) ? R_DOWN : R_CRASH; | |
912 | for (p = utmplist; p; p = next) { | |
913 | next = p->next; | |
914 | free(p); | |
915 | } | |
916 | utmplist = NULL; | |
917 | down = 0; | |
918 | } | |
919 | } | |
920 | printf("\n%s begins %s", mybasename(ufile), ctime(&begintime)); | |
921 | ||
922 | fclose(fp); | |
923 | ||
924 | /* | |
925 | * Should we free memory here? Nah. This is not NT :) | |
926 | */ | |
927 | return 0; | |
928 | } |