linux who 原理

import os
import struct
import time

UTMP_FILE = "/var/run/utmp"
WTMP_FILE = "/var/log/wtmp"

# utmp结构体定义（简化版）
UTMP_FORMAT = "hi32s4s32s256shhiii4i20x"
UTMP_SIZE = struct.calcsize(UTMP_FORMAT)

def read_utmp(file_path):
    with open(file_path, "rb") as f:
        while True:
            entry = f.read(UTMP_SIZE)
            if not entry:
                break
            data = struct.unpack(UTMP_FORMAT, entry)
            user = data[4].decode('utf-8', 'ignore').strip('\x00')
            tty = data[5].decode('utf-8', 'ignore').strip('\x00')
            login_time = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(data[8]))
            if user and tty:
                print(f"{user} {tty} {login_time}")

# 读取并显示当前登录用户信息
read_utmp(UTMP_FILE)

# 若要读取历史登录记录，可取消以下注释：
# read_utmp(WTMP_FILE)