Detect Slackers on Linux: Track User Logins and Hours with last and ac

When a manager suspects that some team members are "slacking" ("摸鱼"), a Linux programmer can verify the claim by examining login activity recorded in /var/log/wtmp. The file logs every user login and logout, providing concrete evidence of who is on the system and for how long.

Using last to list login records

The last command reads /var/log/wtmp and prints a detailed list of login sessions. A typical one‑liner to view the most recent five entries and compress multiple spaces is: $ last | head -5 | tr -s " " Without tr -s " " the output contains irregular spacing, making it harder to read.

To focus on a single user, append the username to the command, e.g. last alice. Adding wc -l after last counts the number of login records for that user.

First technique: Count login occurrences per user

Iterate over all home directories, invoke last for each user, and pipe the result to wc -l:

for user in `ls /home`; do
  echo -ne "$user\t"
  last $user | wc -l
 done

Because typing this loop repeatedly is cumbersome, the author saves it as a script show_user_logins.sh:

#!/bin/bash

echo -n "Logins since "
who /var/log/wtmp | head -1 | awk '{print $3}'

echo "======================="

for user in `ls /home`; do
  echo -ne "$user\t"
  last $user | wc -l
done

Make the script executable with chmod +x show_user_logins.sh and run it:

$ ./show_user_logins
Logins since 2019-12-05
=======================
liangxu    423
jadep      124
... (other users)

Second technique: Measure total online time per user

The ac command reports the total login time for a user (in hours). Example:

$ ac alex
        total       31.61

To obtain this metric for every user, loop over the home directories, invoke ac, and use sed to replace the generic "total" label with the actual username and trim leading tabs:

for user in `ls /home`; do
  ac $user | sed "s/^\t//" | sed "s/total/$user\t/"
done

Saving the loop as show_user_hours.sh yields a reusable tool:

#!/bin/bash

echo -n "hours online since "
who /var/log/wtmp | head -1 | awk '{print $3}'

echo "============================="

for user in `ls /home`; do
  ac $user | sed "s/^\t//" | sed "s/total/$user\t/"
done

After making it executable ( chmod +x show_user_hours.sh) and running it, you get a table of total hours per user:

$ ./show_user_hours
hours online since 2019-12-05
=============================
liangxu        3563.60
jadep          186.04
... (other users)

These two scripts quickly reveal which users log in frequently and who spends the most time on the server, giving managers concrete data to address slack behavior.