Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

Create a login/logout tracking log file for all users System
I have a Mac that I share with my kids. I've given each of them their own account and use parental controls to control what they can access. This gives me a lot of control, but does not tell me everything I want to know. I was also curious about their usage habits, such as what time of day they login and how long they typically are on the computer, so I needed a way to track that data.

After reading about login hooks in OS X, and doing a little more research on the web, I came up with a few simple scripts that can be run at login and logout to solve my problem. With these scripts, any time anyone logs into or out of the computer, a log entry will be created. If you keep your log file in the /var/log directory, then you can easily view the file using the Console application.

So here's how I did it.
  1. Create the login and logout scripts as follows. Here's the login script:
    #!/bin/bash
    # login script
    
    username=${1}
    timestamp=`date ''+%m-%d-%Y_%H:%M:%S''`
    computer=`hostname`
    logfile="/var/log/usertracking.log"
    
    echo $username," "$timestamp," "$computer," login" >> "$logfile"
    And here's the logout script:
    #!/bin/bash
    # logout script
    
    username=${1}
    timestamp=`date ''+%m-%d-%Y_%H:%M:%S''`
    computer=`hostname`
    logfile="/var/log/usertracking.log"
    
    echo $username," "$timestamp," "$computer," logout" >> "$logfile"
  2. Save the scripts in /usr/local/bin as loginscript and logoutscript, respectively.

  3. Run the following Terminal commands to give the scripts execute permissions:
     $ sudo chown a+x /usr/local/bin/loginscript
     $ sudo chown a+x /usr/local/bin/logoutscript
  4. Run the following two Terminal commands to create the login and logout hooks:
     $ sudo defaults write com.apple.loginwindow \
       LoginHook /usr/local/bin/loginscript 
     $ sudo defaults write com.apple.loginwindow \
       LogoutHook /usr/local/bin/logoutscript
That's it! Now you have a way to see everyone's login and logout times. When you want to view the log, just open the Console application, go to the /var/log section, and click on the usertracking.log file. The first time somebody logs in or out the log file will be created.

To remove these changes, type the following commands in Terminal:
 $ sudo defaults delete com.apple.loginwindow LoginHook
 $ sudo defaults delete com.apple.loginwindow LogoutHook
 $ sudo rm /usr/local/bin/loginscript
 $ sudo rm /usr/local/bin/logoutscript
 $ sudo rm /var/log/usertracking.log
You can also track who logs into your computer via file sharing over your network, as explained in this hint. You can also completely disable the ability for guests to login via file sharing, as explained in this hint.

Good luck!
    •    
  • Currently 2.83 / 5
  You rated: 2 / 5 (6 votes cast)
 
[46,496 views]  

Create a login/logout tracking log file for all users | 20 comments | Create New Account
Click here to return to the 'Create a login/logout tracking log file for all users' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Create a login/logout tracking log file for all users
Authored by: ctweed on Aug 18, '06 07:40:02AM

I haven't studied this hint in detail, so I may be badly wrong, but couldn't you use the 'last' command in the Terminal to get this information?

Chris



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: foilpan on Aug 18, '06 08:24:02AM

yeah, why not use last instead?



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: rhowell on Aug 18, '06 08:41:03AM

$ last | more



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: regulus on Aug 18, '06 09:01:56AM

That's funny. I never knew about the last command.

Does last's log file get deleted every month during the automatic log cleaning of the system? When I check the log it only goes back to Aug 1st, but checking the log from my hint it goes back to June when I first implemented this hint. If the log is deleted every month then I think I'll stick with my solution because checking last on Aug 1st will not tell me what happened on July 31st.



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: judielaine on Aug 18, '06 09:29:24AM

You could likely change the log rolling to not change wtmp. Or, set up a cronjob to execute last and save the output into a file you own.

Last produces binary file with the permissions

-rw-r--r-- 1 root admin 19836 Aug 18 10:09 /var/log/wtmp

The root ownership and read only permissions for non-root users prevents basic abuse. While your children may be trusted to respect parental limits, and thus your script may be fine, for system administrators who need to track usage of a machine, last is very reliable. It also logs ftp, ssh, and telnet access.



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: judielaine on Aug 18, '06 10:01:52AM

"The login hook will be run as root."

Ignore my previous comment.



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: gunnmjk on Aug 19, '06 02:30:35AM

Although the 'last' commands' login log gets cleaned out every once and a while, it appears that archives are stored in /var/log/wtmp.n.gz where 'n' is sequential to how many times it has been archived. Unzip the file, and use last -f <file> to view the archived log.

Thanks for the tip, it lead me to figure this out.



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: regulus on Aug 18, '06 09:52:44AM

By having these scripts run at login and logout, I've found other uses for them too. I can add other script code to my scripts to have other things performed on my mac too.

For example, I've disabled the startup chime when my mac reboots. I added the code /usr/bin/osascript -e 'set volume 4' to the loginscript and /usr/bin/osascript -e 'set volume 0' to the logoutscript. This way my volume gets set to zero when I logout and thus the startup chime is muted, and the volume gets set to a consistent level (i.e. 4) when I boot up.



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: xfile087 on Aug 22, '06 06:15:37PM

After seeing what you added, I decided to use "/usr/sbin/diskutil unmount /dev/disk0s3" in mine to unmount my Windows partition on login :D



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: regulus on Aug 22, '06 09:57:55PM

Yes, the login/logout hooks are very powerful. There's much that can be done that you can't do with the "login items" in the accounts preference pane.



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: barefootguru on Aug 18, '06 08:19:46PM

Interested to know why everybody on your Mac logs in and out--why not use Fast User Switching?



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: sjk on Aug 19, '06 10:30:33PM

Limiting usage to a single login session instead of using Fast User Switching can improve performance on systems with less memory.



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: BohrMe on Aug 19, '06 07:34:40PM

I am not a fan of the last command because the wtmp database can become corrupted very easily. I don't know why but it it can. That is why a third party logger can be very helpful.

These kinds of things are important to me because of the kind of logging that I'm required to maintain on my systems. This problem doesn't just show up on Macs. It can show up in Solaris, Linux, IRIX and HP-UX.



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: Dolomite on Aug 20, '06 08:31:11AM

You could just use 'last'



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: pub3abn on Aug 21, '06 06:36:36AM

Related, but a little off-topic: Is there a way to monitor file system changes? Specifically, some time ago we lost a bunch of files, which may possibly have been intentionally deleted by a malicious user. But we have not found a way to determine when and by whom the files were deleted. Does anyone know a good monitoring solution for this type of situation?



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: n1mie on Aug 21, '06 08:22:49AM
I use the 'last' command as follows and have it emailed to me from their computer each day at 9 PM (the time when the eldest loses further internet access).

last | grep "$( date | cut -c5-10 )" | cut -c1-10,37-75 | sort

What it does: performs the last command passes the results to grep which filters all but those which match todays date passes that to the cut command which just gives me the username and start to stop times then it is sorted so each user's data is grouped together

---
--Chip

[ Reply to This | # ]

Create a login/logout tracking log file for all users
Authored by: david-bo on Aug 22, '06 02:02:04PM

Interesting that no one said anything about the big implication with this hint: you are spying on your kids.

I don't want my employer to collect this type of data about me, why would it be ok just because the subject can't defend him-/herself?

---
http://www.google.com/search?as_q=%22Authored+by%3A+david-bo%22&num=10&hl=en&ie=ISO-8859-1&btnG=



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: regulus on Aug 22, '06 09:34:30PM

You don't think your employer collects data about you??? Really? Anyway, as an adult maybe you don't need supervision... but kids certainly do. That's my responsibility.



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: PostScript on Jul 20, '07 11:13:02AM

Eh... pardon my ignorance, but a few things:

1. How do you create scripts?
2. My computer has no /usr/local/bin, so I have no idea how to save the script, if I knew how to make one.
3. My terminal is saying that it does not recognize a+x.
4. My terminal is saying that it does not recognize ?.

Er, sorry if these are obvious questions, but I'm not a very proficient user.

---
Phillip
"I played a blank tape on full volume. The mime who lives next door complained." -SW



[ Reply to This | # ]
Create a login/logout tracking log file for all users
Authored by: jamesconroyfinn on Oct 15, '07 09:20:48AM

1. How do you create scripts?

In a plaintext editor like TextEdit, or my favourite TextMate. BBEdit is the other major editor but it's expensive IMO.

2. My computer has no /usr/local/bin, so I have no idea how to save the script, if I knew how to make one.

You need to be an administrator and enable root access to tinker with the contents of /usr. If you have the priveleges necessary use:

sudo mkdir -p /usr/local/bin

to create the necessary directories all the way down to /usr/local/bin

3. My terminal is saying that it does not recognize a+x.

Once the scripts exist in the /usr/local/bin directory use…

chmod +x /usr/local/bin/loginscript

…to enable execution. You'll need to change loginscript to the name of your script, whatever that may be.

4. My terminal is saying that it does not recognize ?.

What exactly is the response from Terminal? Is it that terminal does not recognise a question mark or are you trying to work with files that don't exist??

The errors may be due to the scripts being located somewhere other than where you're chmod'ing.

---
James

[ Reply to This | # ]