linux查看ssh连接时长

who

user     pts/0        2023-10-01 10:00 (:0)
user     pts/1        2023-10-01 11:00 (:0)

w

 10:15:23 up 1 day,  3:20,  2 users,  load average: 0.10, 0.05, 0.01
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
user     pts/0    :0               10:00    1:23m  0.10s  0.03s -bash
user     pts/1    :0               11:00   10:15  0.15s  0.10s -bash

last

user     pts/0        :0               Mon Oct  1 10:00   still logged in
user     pts/1        :0               Mon Oct  1 11:00   still logged in

journalctl _SYSTEMD_UNIT=sshd.service

-- Logs begin Oct 01 10:00:00 hostname, end Oct 01 12:00:00 hostname. --
Oct 01 10:00:00 hostname sshd[1234]: Accepted password for user from 192.168.1.1 port 54321 ssh2
Oct 01 10:00:00 hostname sshd[1234]: pam_unix(sshd:session): session opened for user user by (uid=0)

#!/bin/bash

LOG_FILE="/var/log/ssh_connections.log"

# 记录当前SSH连接
who | awk '{print $1, $2, $3}' >> $LOG_FILE

# 计算连接时长
while read -r line; do
  user=$(echo $line | awk '{print $1}')
  tty=$(echo $line | awk '{print $2}')
  login_time=$(echo $line | awk '{print $3}')
  current_time=$(date +"%Y-%m-%d %H:%M")
  duration=$(($(date -d "$current_time" +%s) - $(date -d "$login_time" +%s)))
  echo "User: $user, TTY: $tty, Login Time: $login_time, Duration: $duration seconds" >> /var/log/ssh_connection_durations.log
done < $LOG_FILE