{"id":268170,"date":"2015-11-13T16:05:03","date_gmt":"2015-11-13T13:05:03","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=268170"},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-29T21:00:00","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=268170","title":{"rendered":"\u0410 \u0431\u044b\u043b \u043b\u0438 who \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435?"},"content":{"rendered":"<p>       \u0422\u044f\u043f\u043d\u0438\u0446\u0430\u2026 \u0442\u0440\u0438\u043d\u0430\u0434\u0446\u0430\u0442\u043e\u0435\u2026 \u0432\u0441\u0451 \u0432\u0430\u0436\u043d\u043e\u0435 \u0440\u0435\u0448\u0438\u043b\u0438 \u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043d\u0430 \u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a, \u0430 \u043f\u043e\u0442\u043e\u043c\u0443 \u0441\u0434\u0435\u043b\u0430\u044e \u043a\u0430\u043a\u0443\u044e-\u043d\u0438\u0431\u0443\u0434\u044c \u0433\u0430\u0434\u043e\u0441\u0442\u044c\u2026<br \/>  \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u043f\u043e\u044f\u0432\u0438\u0432\u0438\u0448\u0438\u043c\u0441\u044f \u043d\u0430 <a href=\"http:\/\/habrahabr.ru\/company\/ua-hosting\/blog\/270687\/\">\u0445\u0430\u0431\u0440\u0435 <\/a>\u043f\u0435\u0440\u0435\u0441\u043a\u0430\u0437\u043e\u043c <a href=\"http:\/\/www.itworld.com\/article\/2914650\/linux\/checking-last-logins-with-lastlog.html\">\u0441\u0442\u0430\u0442\u044c\u0438<\/a> \u0440\u0435\u0448\u0438\u043b \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e\u0442\u0431\u0430\u043b\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u043e\u0435 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e. \u0421\u043a\u0440\u044b\u0442\u044c \u0441\u0432\u043e\u0451 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0435, \u043a\u043e\u043d\u0435\u0447\u043d\u043e, \u043d\u0435 \u0441\u043e\u0432\u0441\u0435\u043c \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u043e, \u043d\u043e \u043e\u0441\u043e\u0431\u044b\u0445 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439 \u044d\u0442\u043e \u043d\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442. <br \/>  \u0418\u0442\u0430\u043a, \u0437\u0430\u0434\u0430\u0447\u0430:<br \/>  \u0412\u043e\u0439\u0442\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043d\u0435\u043a\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0438 \u00ab\u043f\u043e\u0434\u043c\u0435\u0441\u0442\u0438\u00bb \u0437\u0430 \u0441\u043e\u0431\u043e\u0439.<\/p>\n<p>  \u0417\u0434\u0435\u0441\u044c \u0438 \u0434\u0430\u043b\u0435\u0435 \u0441\u0447\u0438\u0442\u0430\u0435\u043c, \u0447\u0442\u043e \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0441\u043b\u0435\u0436\u0435\u043d\u0438\u044f( \u0437\u0430 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u00ab\u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e\u00bb) \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0438 \u043c\u044b \u0437\u043d\u0430\u0435\u043c \u043f\u0430\u0440\u043e\u043b\u044c root&#8217;a.<br \/>  <img decoding=\"async\" align=\"right\" width=\"50%\" src=\"https:\/\/habrastorage.org\/files\/390\/73c\/459\/39073c45922649a58baa934317068359.png\"\/><br \/>  \u0421 \u0447\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u043c:<\/p>\n<pre><code class=\"bash\"># uname -ori FreeBSD 10.0-RELEASE GENERIC <\/code><\/pre>\n<p>  <\/p>\n<pre><code class=\"bash\"># `echo $SHELL` --version tcsh 6.18.01 (Astron) <\/code><\/pre>\n<p>  \u041e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c\u043e\u0435 \u043d\u0438\u0436\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u0438\u0441\u0441\u043e\u043d\u0438\u0440\u0443\u0435\u0442 \u0441 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u043c\u043e\u0439 \u0432\u044b\u0448\u0435 \u0441\u0442\u0430\u0442\u044c\u0435\u0439, \u0442.\u043a. \u043e\u043d\u0430\u044f \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043e\u0440\u0438\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 Linux-\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043d\u043e \u043e\u0431\u0449\u0438\u0435 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u044b \u0442\u0435\u0436\u0435 \u0438 \u043f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u0432\u043e FreeBSD(c 9.0) \u043d\u0430 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 utmpx \u0440\u043e\u0434\u0441\u0442\u0432\u043e \u0441\u0442\u0430\u043b\u043e \u0431\u043b\u0438\u0436\u0435.<\/p>\n<p>  \u041f\u043e\u0435\u0445\u0430\u043b\u0438\u2026<br \/>  <a name=\"habracut\"><\/a><br \/>  \u0414\u0430\u043d\u043d\u044b\u0435 \u043e \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u044f\u0445 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0432 3 \u0444\u0430\u0439\u043b\u0430\u0445:<\/p>\n<p>  \u0410\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u2014 \/var\/run\/utx.active (\u0437\u0430\u043c\u0435\u043d\u0438\u043b \u0432 9.0 utmp)<br \/>  \u041f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u044f \u2014 \/var\/log\/utx.lastlogin (\u0437\u0430\u043c\u0435\u043d\u0438\u043b lastlog)<br \/>  \u041d\u0443 \u0438 \u043f\u043e\u043b\u043d\u044b\u0439 \u043b\u043e\u0433 \u2014 \/var\/log\/utx.log (\u0437\u0430\u043c\u0435\u043d\u0438\u043b wtmp)<\/p>\n<p>  \u0418 \u0432\u043e\u0442 \u043c\u044b \u0432\u043e\u0448\u043b\u0438:  <\/p>\n<pre><code class=\"bash\"># getent utmpx active getent utmpx active [1447261331.491910 -- Wed Nov 11 20:02:11 2015] system boot [1437293217.427108 -- Sun Jul 19 11:06:57 2015] user process: id=&quot;3a873cda545eff7f&quot; pid=&quot;1288&quot; user=&quot;root&quot; line=&quot;ttyv1&quot; host=&quot;&quot; [1447311304.396008 -- Thu Nov 12 09:55:04 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;4104&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;10.3.1.15&quot; [1447410352.840653 -- Fri Nov 13 13:25:52 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;14281&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;108.182.182.209&quot; [1412600841.811588 -- Mon Oct  6 16:07:21 2014] user process: id=&quot;3962386266747064&quot; pid=&quot;39819&quot; user=&quot;swimmer&quot; line=&quot;ftpd&quot; host=&quot;10.34.1.23&quot; <\/code><\/pre>\n<p>  \u0421\u0447\u0438\u0442\u0430\u0435\u043c, \u0447\u0442\u043e \u0442\u043e\u0442 \u0441\u0430\u043c\u044b\u0439 \u0432\u0445\u043e\u0434 \u043e\u0442 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0436\u0435\u043b\u0430\u0435\u043c \u0438\u0437\u0431\u0430\u0432\u0438\u0442\u044c\u0441\u044f:  <\/p>\n<pre><code class=\"bash\">[1447410352.840653 -- Fri Nov 13 13:25:52 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;14281&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;108.182.182.209&quot; <\/code><\/pre>\n<p>  \u0422.\u043a. \u043d\u0430\u0448 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u0432\u0445\u043e\u0434 \u0432\u0438\u0434\u0435\u043d \u043f\u043e  <\/p>\n<pre><code class=\"bash\"># who who root             ttyv1        Jul 19 11:06 Alex             pts\/1        Nov 12 09:55 (10.3.1.15) Alex             pts\/0        Nov 13 13:25 (108.182.182.209) <\/code><\/pre>\n<p>  \u041d\u0430\u0447\u0438\u043d\u0430\u0435\u043c \u0441 \u043d\u0435\u0433\u043e  <\/p>\n<pre><code class=\"bash\"># utx rm 8084832f30000000 utx rm 8084832f30000000 <\/code><\/pre>\n<p>  \u0422\u0430\u043a \u043b\u0443\u0447\u0448\u0435  <\/p>\n<pre><code class=\"bash\"># who who root             ttyv1        Jul 19 11:06 Alex             pts\/1        Nov 12 09:55 (10.3.1.15) <\/code><\/pre>\n<p>  <\/p>\n<pre><code class=\"cs\"># getent utmpx active getent utmpx active [1447261331.491910 -- Wed Nov 11 20:02:11 2015] system boot [1437293217.427108 -- Sun Jul 19 11:06:57 2015] user process: id=&quot;3a873cda545eff7f&quot; pid=&quot;1288&quot; user=&quot;root&quot; line=&quot;ttyv1&quot; host=&quot;&quot; [1447311304.396008 -- Thu Nov 12 09:55:04 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;4104&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;10.3.1.15&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;0&quot; [1412600841.811588 -- Mon Oct  6 16:07:21 2014] user process: id=&quot;3962386266747064&quot; pid=&quot;39819&quot; user=&quot;swimmer&quot; line=&quot;ftpd&quot; host=&quot;10.34.1.23&quot; <\/code><\/pre>\n<p>  \u041d\u0430\u0434\u043e \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u044d\u0442\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043e\u0431 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0441\u0441\u0438\u0438 \u043d\u0435 \u0431\u044b\u043b\u043e \u0438\u0434\u0435\u0430\u043b\u044c\u043d\u044b\u043c \u0438 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0441\u043b\u0435\u0434 \u043e \u043d\u0435\u0439 \u043e\u0441\u0442\u0430\u043b\u0441\u044f:  <\/p>\n<pre><code class=\"bash\">[1447410438.824887 -- Fri Nov 13 13:27:18 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;0&quot; <\/code><\/pre>\n<p>  \u041a\u0430\u043a \u0443\u0434\u0430\u043b\u044f\u0442\u044c \u00ab\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u00bb \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u043d\u0438\u0436\u0435.<\/p>\n<p>  \u041d\u0430\u043f\u0430\u043a\u043e\u0441\u0442\u0438\u0432 \u043c\u044b \u0440\u0435\u0448\u0430\u0435\u043c \u043f\u043e\u043a\u0438\u043d\u0443\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443<br \/>  \u0427\u0442\u043e \u0436\u0435 \u043e\u0441\u0442\u0430\u043b\u043e\u0441\u044c \u0432 \u043b\u043e\u0433\u0430\u0445  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">getent<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"bash\"># getent utmpx lastlogin getent utmpx lastlogin [1437293217.427108 -- Sun Jul 19 11:06:57 2015] user process: id=&quot;3a873cda545eff7f&quot; pid=&quot;1288&quot; user=&quot;root&quot; line=&quot;ttyv1&quot; host=&quot;&quot; [1447410352.840653 -- Fri Nov 13 13:25:52 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;14281&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;108.182.182.209&quot; [1412600841.811588 -- Mon Oct  6 16:07:21 2014] user process: id=&quot;3962386266747064&quot; pid=&quot;39819&quot; user=&quot;swimmer&quot; line=&quot;ftpd&quot; host=&quot;10.34.1.23&quot; <\/code><\/pre>\n<pre><code class=\"bash\"># getent utmpx log getent utmpx log [1446494176.682516 -- Mon Nov  2 22:56:16 2015] user process: id=&quot;8084832f32000000&quot; pid=&quot;72946&quot; user=&quot;Alex&quot; line=&quot;pts\/2&quot; host=&quot;108.182.182.209&quot; [1446498691.474026 -- Tue Nov  3 00:11:31 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;61263&quot; [1446614492.857275 -- Wed Nov  4 08:21:32 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;79491&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;30.205.96.92&quot; [1446614507.736041 -- Wed Nov  4 08:21:47 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;79491&quot; [1446698146.439426 -- Thu Nov  5 07:35:46 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;83858&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;30.205.116.124&quot; [1446706228.892627 -- Thu Nov  5 09:50:28 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;83858&quot; [1446710834.014993 -- Thu Nov  5 11:07:14 2015] system shutdown [1446710906.311914 -- Thu Nov  5 11:08:26 2015] system boot [1446710938.817058 -- Thu Nov  5 11:08:58 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;1313&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;10.3.1.15&quot; [1446721174.063221 -- Thu Nov  5 13:59:34 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;1789&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;108.182.182.209&quot; [1446815955.085182 -- Fri Nov  6 16:19:15 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;1313&quot; [1446906334.551710 -- Sat Nov  7 17:25:34 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;11580&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;108.182.182.209&quot; [1446912588.809728 -- Sat Nov  7 19:09:48 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;1789&quot; [1447045707.708080 -- Mon Nov  9 08:08:27 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;19008&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;mm-21-205-84-93.dynamic.pppoe.mgts.ru&quot; [1447045911.315244 -- Mon Nov  9 08:11:51 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;19008&quot; [1447052181.641530 -- Mon Nov  9 09:56:21 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;19314&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;10.3.1.15&quot; [1447131335.768107 -- Tue Nov 10 07:55:35 2015] user process: id=&quot;8084832f33000000&quot; pid=&quot;23441&quot; user=&quot;Alex&quot; line=&quot;pts\/3&quot; host=&quot;30.205.98.54&quot; [1447133646.400779 -- Tue Nov 10 08:34:06 2015] dead process: id=&quot;8084832f33000000&quot; pid=&quot;23441&quot; [1447261331.491910 -- Wed Nov 11 20:02:11 2015] system boot [1447263839.850262 -- Wed Nov 11 20:43:59 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;1422&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;10.3.1.15&quot; [1447267906.123055 -- Wed Nov 11 21:51:46 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;1644&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;10.3.1.15&quot; [1447271644.777315 -- Wed Nov 11 22:54:04 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;1422&quot; [1447275711.000315 -- Thu Nov 12 00:01:51 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;1644&quot; [1447303224.172811 -- Thu Nov 12 07:40:24 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;3685&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;30.205.135.101&quot; [1447305113.718172 -- Thu Nov 12 08:11:53 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;3685&quot; [1447309547.097136 -- Thu Nov 12 09:25:47 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;4018&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;108.182.182.209&quot; [1447311304.396008 -- Thu Nov 12 09:55:04 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;4104&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;10.3.1.15&quot; [1447316907.634554 -- Thu Nov 12 11:28:27 2015] user process: id=&quot;8084832f32000000&quot; pid=&quot;4373&quot; user=&quot;Alex&quot; line=&quot;pts\/2&quot; host=&quot;108.182.182.209&quot; [1447322795.387121 -- Thu Nov 12 13:06:35 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;4018&quot; [1447410352.840653 -- Fri Nov 13 13:25:52 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;14281&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;108.182.182.209&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;0&quot;  <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  \u0412\u0441\u0435 \u044d\u0442\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0432 \u0431\u0438\u043d\u0430\u0440\u043d\u043e\u043c \u0432\u0438\u0434\u0435 \u0432 utmpx \u0441\u0442\u0443\u043a\u0442\u0443\u0440\u0430\u0445. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0443\u0434\u0430\u043b\u0438\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e:<br \/>   \u2014 \u043b\u0438\u0431\u043e \u0443\u0434\u0430\u043b\u0438\u0442\u044c \u0441\u0430\u043c\u0438 \u0444\u0430\u0439\u043b\u044b \u0441 \u043b\u043e\u0433\u0430\u043c\u0438;<br \/>   \u2014 \u043b\u0438\u0431\u043e \u0437\u0430\u0431\u0438\u0442\u044c \u0438\u0445 \u043d\u0443\u043b\u044f\u043c\u0438 \u0432 hex-\u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435;<br \/>   \u2014 \u043b\u0438\u0431\u043e \u043e\u0442\u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0431\u0438\u043d\u0430\u0440\u043d\u044b\u0439 \u043b\u043e\u0433 \u0443\u0434\u0430\u043b\u0438\u0432 \u0438\u0437 \u043d\u0435\u0433\u043e \u0437\u0430\u043f\u0438\u0441\u044c \u043e \u043d\u0430\u0448\u0435\u043c \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0438;<br \/>  \u0414\u0432\u0430 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043f\u043e\u0441\u043e\u0431\u0430, \u043a\u043e\u043d\u0435\u0447\u043d\u043e, \u0443\u0434\u0430\u043b\u044f\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0438, \u043d\u043e \u0434\u0430\u0434\u0443\u0442 \u043f\u043e\u043d\u044f\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u043c\u0443 \u0430\u0434\u043c\u0438\u043d\u0443, \u0447\u0442\u043e \u0434\u0435\u043b\u043e \u043d\u0435\u0447\u0438\u0441\u0442\u043e. \u0427\u0442\u043e\u0436 \u043f\u043e\u0439\u0434\u0451\u043c \u0441\u0430\u043c\u044b\u043c \u0441\u043b\u043e\u0436\u043d\u044b\u043c \u043f\u0443\u0442\u0451\u043c.<br \/>  \u0421\u0442\u0443\u043a\u0442\u0443\u0440\u0430 utmpx \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439<\/p>\n<pre><code class=\"cpp\">           struct utmpx {                    short           ut_type;    \/* Type of entry. *\/                    struct timeval  ut_tv;      \/* Time entry was made. *\/                    char            ut_id[];    \/* Record identifier. *\/                    pid_t           ut_pid;     \/* Process ID. *\/                    char            ut_user[];  \/* User login name. *\/                    char            ut_line[];  \/* Device name. *\/                    char            ut_host[];  \/* Remote hostname. *\/            };  <\/code><\/pre>\n<p>  \u041f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 accounting \u0431\u0430\u0437\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439 \u043e\u043f\u0435\u0440\u0438\u0440\u0443\u044e\u0442 endutxent, getutxent, getutxid, getutxline, getutxuser, pututxline, setutxdb, setutxent.<br \/>  \u041d\u0430\u0441 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u0443\u044e\u0442 \u0434\u0432\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438:<br \/>  getutxent \u2014 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u0431\u0430\u0437\u044b \u0432 \u0432\u0438\u0434\u0435 utmpx <br \/>  pututxline \u2014 \u0434\u0435\u043b\u0430\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0431\u0430\u0437\u0443<\/p>\n<p>  \u041f\u0440\u043e\u0431\u0435\u0436\u0438\u043c\u0441\u044f \u043f\u043e \u0431\u0430\u0437\u0435, \u0441\u0447\u0438\u0442\u0430\u0435\u043c \u0432\u0441\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u0441\u043e\u0437\u0434\u0430\u0434\u0438\u043c \u043d\u043e\u0432\u0443\u044e \u043a\u043e\u043f\u0438\u044e \u0431\u0430\u0437\u044b \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0432 \u0438\u0437 \u043d\u0435\u0451 \u043d\u0430\u0448\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u044f? <\/p>\n<pre><code class=\"cpp\">\t\twhile ((ut = getutxent()) != NULL) \t\t{ \t\t\tutmpxprint(ut); \t\t\tif(ut-&gt;ut_pid != 14281) pututxline(ut); \t\t} <\/code><\/pre>\n<p>  \u0418 \u0442\u0443\u0442 \u043d\u0430\u0441 \u043e\u0436\u0438\u0434\u0430\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0423\u041f\u0421:  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">\u0423\u041f\u0421<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"bash\">[1447410438.824887 -- Fri Nov 13 13:27:18 2015] user process: id=&quot;8084832f32000000&quot; pid=&quot;72946&quot; user=&quot;Alex&quot; line=&quot;pts\/2&quot; host=&quot;108.182.182.209&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;61263&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;79491&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;30.205.96.92&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;79491&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;83858&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;30.205.116.124&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;83858&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] system shutdown [1447410438.824887 -- Fri Nov 13 13:27:18 2015] system boot [1447410438.824887 -- Fri Nov 13 13:27:18 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;1313&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;10.3.1.15&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;1789&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;108.182.182.209&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;1313&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;11580&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;108.182.182.209&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;1789&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;19008&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;mm-21-205-84-93.dynamic.pppoe.mgts.ru&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;19008&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;19314&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;10.3.1.15&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] user process: id=&quot;8084832f33000000&quot; pid=&quot;23441&quot; user=&quot;Alex&quot; line=&quot;pts\/3&quot; host=&quot;30.205.98.54&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] dead process: id=&quot;8084832f33000000&quot; pid=&quot;23441&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] system boot [1447410438.824887 -- Fri Nov 13 13:27:18 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;1422&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;10.3.1.15&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;1644&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;10.3.1.15&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;1422&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;1644&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;3685&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;30.205.135.101&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;3685&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;4018&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;108.182.182.209&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;4104&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;10.3.1.15&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] user process: id=&quot;8084832f32000000&quot; pid=&quot;4373&quot; user=&quot;Alex&quot; line=&quot;pts\/2&quot; host=&quot;108.182.182.209&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;4018&quot; [1447410438.824887 -- Fri Nov 13 13:27:18 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;0&quot;  <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  \u0417\u0430\u043f\u0438\u0441\u044c 14281 \u0438\u0441\u0447\u0435\u0437\u043b\u0430, \u043d\u043e \u0432\u0441\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432\u043d\u0435\u0441\u043b\u0438\u0441\u044c \u0432 \u0446\u0435\u043b\u0435\u0432\u0443\u044e \u0431\u0430\u0437\u0443 \u0441 \u0442\u0435\u043a\u0443\u0449\u0438\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c!<br \/>  \u041f\u043e\u0447\u0435\u043c\u0443 \u0436\u0435 \u0442\u0430\u043a \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442?<\/p>\n<p>  \u0418\u0434\u0451\u043c \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u0438\u043a\u0438 pututxline.c<br \/>  \u0438 \u0432\u0438\u0434\u0438\u043c:  <\/p>\n<pre><code class=\"cpp\">struct utmpx * pututxline(const struct utmpx *utmpx) { \tstruct futx fu;     ...         utx_to_futx(utmpx, &fu);     ... \tbad |= utx_log_add(&fu);     ... }  <\/code><\/pre>\n<p>\u0442.\u0435. \u043f\u0435\u0440\u0435\u0434 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u043d\u0430\u0448\u0430 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 utmpx \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u043d\u0435\u043a\u0443\u044e futx (\u0437\u0430\u0447\u0435\u043c \u043d\u0435\u043f\u043e\u043d\u044f\u0442\u043d\u043e \u0442.\u043a. \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u043d\u0438\u0447\u0435\u043c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u043d\u0435 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f, \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u044e, \u0447\u0442\u043e \u00ab\u043f\u0430\u043c\u044f\u0442\u044c\u00bb \u043e \u043f\u0440\u043e\u0448\u043b\u044b\u0445 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u0445)<br \/>  \u0421\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u0438 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 \u0432\u0440\u0435\u043c\u0435\u043d\u0438<br \/>  <i>utmpx ut_tv<\/i> \u0432 <i>futx fu_tv <\/i><\/p>\n<pre><code class=\"cpp\">#define\tUTOF_TV(fu) do { \\ \tstruct timeval tv;\t\t\t\t\t\t\\ \tgettimeofday(&tv, NULL);\t\t\t\t\t\\ \t(fu)-&gt;fu_tv = htobe64((uint64_t)tv.tv_sec * 1000000 +\t\t\\ \t    (uint64_t)tv.tv_usec);\t\t\t\t\t\\ } while (0) <\/code><\/pre>\n<p>  <i>gettimeofday(&#038;tv, NULL); <\/i> \u2014 \u0417\u0410\u0427\u0415\u041c!?, \u0435\u0441\u043b\u0438 \u044f \u043f\u0435\u0440\u0435\u0434\u0430\u044e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u0430 \u0443\u0436\u0435 \u0437\u0430\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u0443\u044e \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c \u0441\u0442\u0443\u0440\u043a\u0442\u0443\u0440\u0443?<br \/>  \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u043a \u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0435\u043c\u0443 \u0432\u0438\u0434\u0443:  <\/p>\n<pre><code class=\"cpp\">#define\tUTOF_TV(ut, fu) do { \\ \t(fu)-&gt;fu_tv = htobe64((uint64_t)(ut)-&gt;ut_tv.tv_sec * 1000000 +\t\\ \t    (uint64_t)(ut)-&gt;ut_tv.tv_usec);\t\t\t\t\\ } while (0)  <\/code><\/pre>\n<p>  \u041b\u0438\u0441\u0442\u0438\u043d\u0433\u0438 \u0442\u043e\u0433\u043e \u0447\u0442\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u043e\u0441\u044c \u043d\u0438\u0436\u0435:  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">getent.c<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"cpp\">#include &lt;sys\/cdefs.h&gt; __FBSDID(&quot;$FreeBSD: getent editor v 0.0.a $&quot;);  #include &lt;sys\/socket.h&gt; #include &lt;sys\/param.h&gt; #include &lt;arpa\/inet.h&gt; #include &lt;arpa\/nameser.h&gt; #include &lt;net\/if.h&gt; #include &lt;netinet\/if_ether.h&gt; #include &lt;netinet\/in.h&gt;\t\t\/* for INET6_ADDRSTRLEN *\/ #include &lt;rpc\/rpcent.h&gt;  #include &lt;assert.h&gt; #include &lt;ctype.h&gt; #include &lt;errno.h&gt; #include &lt;grp.h&gt; #include &lt;limits.h&gt; #include &lt;netdb.h&gt; #include &lt;pwd.h&gt; #include &lt;stdarg.h&gt; #include &lt;stdint.h&gt; #include &lt;stdio.h&gt; #include &lt;stdlib.h&gt; #include &lt;string.h&gt; #include &lt;unistd.h&gt; #include &quot;utmpx.h&quot; #include &quot;pututxline.c&quot;  static int\tusage(void); static int\tparsenum(const char *, unsigned long *); static int\tutmpx(int, char *[]);  enum { \tRV_OK\t\t= 0, \tRV_USAGE\t= 1, \tRV_NOTFOUND\t= 2, \tRV_NOENUM\t= 3 };  static struct getentdb { \tconst char\t*name; \tint\t\t(*callback)(int, char *[]); } databases[] = { \t{\t&quot;utmpx&quot;,\tutmpx,\t\t}, \t{\tNULL,\t\tNULL,\t\t}, };  int main(int argc, char *argv[]) { \tstruct getentdb\t*curdb;  \tsetprogname(argv[0]);  \tif (argc &lt; 2) \t\tusage(); \tfor (curdb = databases; curdb-&gt;name != NULL; curdb++) { \t\tif (strcmp(curdb-&gt;name, argv[1]) == 0) { \t\t\texit(curdb-&gt;callback(argc, argv)); \t\t} \t} \tfprintf(stderr, &quot;Unknown database: %s\\n&quot;, argv[1]); \tusage(); \t\/* NOTREACHED *\/ \treturn RV_USAGE; }  static int usage(void) { \tstruct getentdb\t*curdb;  \tfprintf(stderr, &quot;Usage: %s database [key ...]\\n&quot;, \t    getprogname()); \tfprintf(stderr, &quot;       database may be one of:\\n\\t&quot;); \tfor (curdb = databases; curdb-&gt;name != NULL; curdb++) { \t\tfprintf(stderr, &quot; %s&quot;, curdb-&gt;name); \t} \tfprintf(stderr, &quot;\\n&quot;); \texit(RV_USAGE); \t\/* NOTREACHED *\/ }   \/*  * printfmtstrings --  *\tvprintf(format, ...),  *\tthen the aliases (beginning with prefix, separated by sep),  *\tthen a newline  *\/ static void printfmtstrings(char *strings[], const char *prefix, const char *sep, \tconst char *fmt, ...) { \tva_list\t\tap; \tconst char\t*curpref; \tint\t\ti;  \tva_start(ap, fmt); \tvprintf(fmt, ap);  \tcurpref = prefix; \tfor (i = 0; strings[i] != NULL; i++) { \t\tprintf(&quot;%s%s&quot;, curpref, strings[i]); \t\tcurpref = sep; \t} \tprintf(&quot;\\n&quot;); \tva_end(ap); }   \/*  * utmpx  *\/  #define\tUTMPXPRINTID do {\t\t\t\\ \tsize_t i;\t\t\t\t\\ \tfor (i = 0; i &lt; sizeof ut-&gt;ut_id; i++)\t\\ \t\tprintf(&quot;%02hhx&quot;, ut-&gt;ut_id[i]);\t\\ } while (0)  static void utmpxprint(const struct utmpx *ut) {  \tif (ut-&gt;ut_type == EMPTY) \t\treturn; \t \tprintf(&quot;[%jd.%06u -- %.24s] &quot;, \t    (intmax_t)ut-&gt;ut_tv.tv_sec, (unsigned int)ut-&gt;ut_tv.tv_usec, \t    ctime(&ut-&gt;ut_tv.tv_sec));  \tswitch (ut-&gt;ut_type) { \tcase BOOT_TIME: \t\tprintf(&quot;system boot\\n&quot;); \t\treturn; \tcase SHUTDOWN_TIME: \t\tprintf(&quot;system shutdown\\n&quot;); \t\treturn; \tcase OLD_TIME: \t\tprintf(&quot;old system time\\n&quot;); \t\treturn; \tcase NEW_TIME: \t\tprintf(&quot;new system time\\n&quot;); \t\treturn; \tcase USER_PROCESS: \t\tprintf(&quot;user process: id=\\&quot;&quot;); \t\tUTMPXPRINTID; \t\tprintf(&quot;\\&quot; pid=\\&quot;%d\\&quot; user=\\&quot;%s\\&quot; line=\\&quot;%s\\&quot; host=\\&quot;%s\\&quot;\\n&quot;, \t\t    ut-&gt;ut_pid, ut-&gt;ut_user, ut-&gt;ut_line, ut-&gt;ut_host); \t\tbreak; \tcase INIT_PROCESS: \t\tprintf(&quot;init process: id=\\&quot;&quot;); \t\tUTMPXPRINTID; \t\tprintf(&quot;\\&quot; pid=\\&quot;%d\\&quot;\\n&quot;, ut-&gt;ut_pid); \t\tbreak; \tcase LOGIN_PROCESS: \t\tprintf(&quot;login process: id=\\&quot;&quot;); \t\tUTMPXPRINTID; \t\tprintf(&quot;\\&quot; pid=\\&quot;%d\\&quot; user=\\&quot;%s\\&quot; line=\\&quot;%s\\&quot; host=\\&quot;%s\\&quot;\\n&quot;, \t\t    ut-&gt;ut_pid, ut-&gt;ut_user, ut-&gt;ut_line, ut-&gt;ut_host); \t\tbreak; \tcase DEAD_PROCESS: \t\tprintf(&quot;dead process: id=\\&quot;&quot;); \t\tUTMPXPRINTID; \t\tprintf(&quot;\\&quot; pid=\\&quot;%d\\&quot;\\n&quot;, ut-&gt;ut_pid); \t\tbreak; \tdefault: \t\tprintf(&quot;unknown record type %hu\\n&quot;, ut-&gt;ut_type); \t\tbreak; \t} }  static int utmpx(int argc, char *argv[]) { \t\/\/const struct utmpx *ut; \tstruct utmpx *ut; \tconst char *file = NULL; \tint rv = RV_OK, db = 0;  \tassert(argc &gt; 1); \tassert(argv != NULL);  \tif (argc == 3 || argc == 4 || argc == 5) { \t\tif (strcmp(argv[2], &quot;active&quot;) == 0) \t\t\tdb = UTXDB_ACTIVE; \t\telse if (strcmp(argv[2], &quot;lastlogin&quot;) == 0) \t\t\tdb = UTXDB_LASTLOGIN; \t\telse if (strcmp(argv[2], &quot;log&quot;) == 0) \t\t\tdb = UTXDB_LOG; \t\telse \t\t\trv = RV_USAGE; \t\tif (argc == 4 || argc == 5) \t\t\tfile = argv[3]; \t} else { \t\trv = RV_USAGE; \t}  \tif (rv == RV_USAGE) { \t\tfprintf(stderr, \t\t    &quot;Usage: %s utmpx active | lastlogin | log [filename]\\n&quot;, \t\t    getprogname()); \t} else if (rv == RV_OK) { \t\tif (setutxdb(db, file) != 0) \t\t\treturn (RV_NOTFOUND);   \t\tint ires = 0; \t\tprintf(&quot;UTXDB_LOG result: [%d]\\n&quot;, ires); \t\tif(argc == 5) \t\t{ \t\t\twhile ((ut = getutxent()) != NULL) \t\t\t{\t \t \t\t\t\tutmpxprint(ut); \t \t\t\t\t\/\/if(strcmp(ut-&gt;ut_host, &quot;10.34.1.155&quot;) != 0) \t\t\t\t\/\/if(ut-&gt;ut_pid != 4373) \t\t\t\t\tif(ut-&gt;ut_pid != atoi(argv[4])) \t\t\t\t\t{ \t\t\t\t\t\tpututxline(ut); \t\t\t\t\t} \t\t\t} \t\t} \t\telse puts(&quot;ut_pid(argv[4]) needed!..&quot;); \t\t \t\tendutxent(); \t} \treturn (rv); }  <\/code><\/pre>\n<\/div>\n<\/div>\n<div class=\"spoiler\"><b class=\"spoiler_title\">pututxline.c<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"cpp\">#include &lt;sys\/cdefs.h&gt; __FBSDID(&quot;$FreeBSD: pututxline.c v 0.0.a $&quot;);  #include &lt;sys\/endian.h&gt; #include &lt;sys\/stat.h&gt; #include &lt;sys\/uio.h&gt; #include &lt;errno.h&gt; #include &lt;fcntl.h&gt; #include &lt;stdio.h&gt; #include &lt;string.h&gt; #include &lt;unistd.h&gt; #include &lt;utmpx.h&gt; #include &quot;\/usr\/src\/lib\/libc\/include\/namespace.h&quot; #include &quot;\/usr\/src\/lib\/libc\/gen\/utxdb.h&quot; #include &quot;\/usr\/src\/lib\/libc\/include\/un-namespace.h&quot;  \/\/----------------------------------------------------------------------------- #include &lt;sys\/param.h&gt; #include &lt;sys\/time.h&gt; #include &lt;stdlib.h&gt; \/\/----------------------------------------------------------------------------- #define\tUTOF_STRING(ut, fu, field) do { \\ \tstrncpy((fu)-&gt;fu_ ## field, (ut)-&gt;ut_ ## field,\t\t\\ \t    MIN(sizeof (fu)-&gt;fu_ ## field, sizeof (ut)-&gt;ut_ ## field));\t\\ } while (0) #define\tUTOF_ID(ut, fu) do { \\ \tmemcpy((fu)-&gt;fu_id, (ut)-&gt;ut_id,\t\t\t\t\\ \t    MIN(sizeof (fu)-&gt;fu_id, sizeof (ut)-&gt;ut_id));\t\t\\ } while (0) #define\tUTOF_PID(ut, fu) do { \\ \t(fu)-&gt;fu_pid = htobe32((ut)-&gt;ut_pid);\t\t\t\t\\ } while (0) #define\tUTOF_TYPE(ut, fu) do { \\ \t(fu)-&gt;fu_type = (ut)-&gt;ut_type;\t\t\t\t\t\\ } while (0) #define\tUTOF_TV(ut, fu) do { \\ \t(fu)-&gt;fu_tv = htobe64((uint64_t)(ut)-&gt;ut_tv.tv_sec * 1000000 +\t\\ \t    (uint64_t)(ut)-&gt;ut_tv.tv_usec);\t\t\t\t\\ } while (0) \/\/----------------------------------------------------------------------------- void utx_to_futx(const struct utmpx *ut, struct futx *fu) {  \tmemset(fu, 0, sizeof *fu);  \tswitch (ut-&gt;ut_type) { \tcase BOOT_TIME: \tcase OLD_TIME: \tcase NEW_TIME: \t\/* Extension: shutdown time. *\/ \tcase SHUTDOWN_TIME: \t\tbreak; \tcase USER_PROCESS: \t\tUTOF_ID(ut, fu); \t\tUTOF_STRING(ut, fu, user); \t\tUTOF_STRING(ut, fu, line); \t\t\/* Extension: host name. *\/ \t\tUTOF_STRING(ut, fu, host); \t\tUTOF_PID(ut, fu); \t\tbreak; \tcase INIT_PROCESS: \t\tUTOF_ID(ut, fu); \t\tUTOF_PID(ut, fu); \t\tbreak; \tcase LOGIN_PROCESS: \t\tUTOF_ID(ut, fu); \t\tUTOF_STRING(ut, fu, user); \t\tUTOF_STRING(ut, fu, line); \t\tUTOF_PID(ut, fu); \t\tbreak; \tcase DEAD_PROCESS: \t\tUTOF_ID(ut, fu); \t\tUTOF_PID(ut, fu); \t\tbreak; \tdefault: \t\tfu-&gt;fu_type = EMPTY; \t\treturn; \t}  \tUTOF_TYPE(ut, fu); \tUTOF_TV(ut, fu); \t\/\/UTOF_TV(ut, fu); }  \/\/----------------------------------------------------------------------------- #define\tFTOU_STRING(fu, ut, field) do { \\ \tstrncpy((ut)-&gt;ut_ ## field, (fu)-&gt;fu_ ## field,\t\t\\ \t    MIN(sizeof (ut)-&gt;ut_ ## field - 1, sizeof (fu)-&gt;fu_ ## field)); \\ } while (0) #define\tFTOU_ID(fu, ut) do { \\ \tmemcpy((ut)-&gt;ut_id, (fu)-&gt;fu_id,\t\t\t\t\\ \t    MIN(sizeof (ut)-&gt;ut_id, sizeof (fu)-&gt;fu_id));\t\t\\ } while (0) #define\tFTOU_PID(fu, ut) do { \\ \t(ut)-&gt;ut_pid = be32toh((fu)-&gt;fu_pid);\t\t\t\t\\ } while (0) #define\tFTOU_TYPE(fu, ut) do { \\ \t(ut)-&gt;ut_type = (fu)-&gt;fu_type;\t\t\t\t\t\\ } while (0) #define\tFTOU_TV(fu, ut) do { \\ \tuint64_t t;\t\t\t\t\t\t\t\\ \tt = be64toh((fu)-&gt;fu_tv);\t\t\t\t\t\\ \t(ut)-&gt;ut_tv.tv_sec = t \/ 1000000;\t\t\t\t\\ \t(ut)-&gt;ut_tv.tv_usec = t % 1000000;\t\t\t\t\\ } while (0) \/\/-----------------------------------------------------------------------------  struct utmpx * futx_to_utx(const struct futx *fu) { #ifdef __NO_TLS \tstatic struct utmpx *ut; #else \tstatic _Thread_local struct utmpx *ut; #endif  \tif (ut == NULL) { \t\tut = calloc(1, sizeof *ut); \t\tif (ut == NULL) \t\t\treturn (NULL); \t} else \t\tmemset(ut, 0, sizeof *ut);  \tswitch (fu-&gt;fu_type) { \tcase BOOT_TIME: \tcase OLD_TIME: \tcase NEW_TIME: \t\/* Extension: shutdown time. *\/ \tcase SHUTDOWN_TIME: \t\tbreak; \tcase USER_PROCESS: \t\tFTOU_ID(fu, ut); \t\tFTOU_STRING(fu, ut, user); \t\tFTOU_STRING(fu, ut, line); \t\t\/* Extension: host name. *\/ \t\tFTOU_STRING(fu, ut, host); \t\tFTOU_PID(fu, ut); \t\tbreak; \tcase INIT_PROCESS: \t\tFTOU_ID(fu, ut); \t\tFTOU_PID(fu, ut); \t\tbreak; \tcase LOGIN_PROCESS: \t\tFTOU_ID(fu, ut); \t\tFTOU_STRING(fu, ut, user); \t\tFTOU_STRING(fu, ut, line); \t\tFTOU_PID(fu, ut); \t\tbreak; \tcase DEAD_PROCESS: \t\tFTOU_ID(fu, ut); \t\tFTOU_PID(fu, ut); \t\tbreak; \tdefault: \t\tut-&gt;ut_type = EMPTY; \t\treturn (ut); \t}  \tFTOU_TYPE(fu, ut); \tFTOU_TV(fu, ut); \treturn (ut); }  \/\/-----------------------------------------------------------------------------  static FILE * futx_open(const char *file) { \tFILE *fp; \tstruct stat sb; \tint fd;  \tfd = open(file, O_CREAT|O_RDWR|O_EXLOCK|O_CLOEXEC, 0644); \tif (fd &lt; 0) \t\treturn (NULL);  \t\/* Safety check: never use broken files. *\/ \tif (fstat(fd, &sb) != -1 && sb.st_size % sizeof(struct futx) != 0) { \t\tclose(fd); \t\terrno = EFTYPE; \t\treturn (NULL); \t}  \tfp = fdopen(fd, &quot;r+&quot;); \tif (fp == NULL) { \t\tclose(fd); \t\treturn (NULL); \t} \treturn (fp); }  static int utx_active_add(const struct futx *fu) { \tFILE *fp; \tstruct futx fe; \toff_t partial; \tint error, ret;  \tpartial = -1; \tret = 0;  \t\/* \t * Register user login sessions.  Overwrite entries of sessions \t * that have already been terminated. \t *\/ \tfp = futx_open(_PATH_UTX_ACTIVE); \tif (fp == NULL) \t\treturn (-1); \twhile (fread(&fe, sizeof(fe), 1, fp) == 1) { \t\tswitch (fe.fu_type) { \t\tcase BOOT_TIME: \t\t\t\/* Leave these intact. *\/ \t\t\tbreak; \t\tcase USER_PROCESS: \t\tcase INIT_PROCESS: \t\tcase LOGIN_PROCESS: \t\tcase DEAD_PROCESS: \t\t\t\/* Overwrite when ut_id matches. *\/ \t\t\tif (memcmp(fu-&gt;fu_id, fe.fu_id, sizeof(fe.fu_id)) == \t\t\t    0) { \t\t\t\tret = fseeko(fp, -(off_t)sizeof(fe), SEEK_CUR); \t\t\t\tgoto exact; \t\t\t} \t\t\tif (fe.fu_type != DEAD_PROCESS) \t\t\t\tbreak; \t\t\t\/* FALLTHROUGH *\/ \t\tdefault: \t\t\t\/* Allow us to overwrite unused records. *\/ \t\t\tif (partial == -1) { \t\t\t\tpartial = ftello(fp); \t\t\t\t\/* \t\t\t\t * Distinguish errors from valid values so we \t\t\t\t * don't overwrite good data by accident. \t\t\t\t *\/ \t\t\t\tif (partial != -1) \t\t\t\t\tpartial -= (off_t)sizeof(fe); \t\t\t} \t\t\tbreak; \t\t} \t}  \t\/* \t * No exact match found.  Use the partial match.  If no partial \t * match was found, just append a new record. \t *\/ \tif (partial != -1) \t\tret = fseeko(fp, partial, SEEK_SET); exact: \tif (ret == -1) \t\terror = errno; \telse if (fwrite(fu, sizeof(*fu), 1, fp) &lt; 1) \t\terror = errno; \telse \t\terror = 0; \tfclose(fp); \tif (error != 0) \t\terrno = error; \treturn (error == 0 ? 0 : 1); }  static int utx_active_remove(struct futx *fu) { \tFILE *fp; \tstruct futx fe; \tint error, ret;  \t\/* \t * Remove user login sessions, having the same ut_id. \t *\/ \tfp = futx_open(_PATH_UTX_ACTIVE); \tif (fp == NULL) \t\treturn (-1); \terror = ESRCH; \tret = -1; \twhile (fread(&fe, sizeof(fe), 1, fp) == 1 && ret != 0) \t\tswitch (fe.fu_type) { \t\tcase USER_PROCESS: \t\tcase INIT_PROCESS: \t\tcase LOGIN_PROCESS: \t\t\tif (memcmp(fu-&gt;fu_id, fe.fu_id, sizeof(fe.fu_id)) != 0) \t\t\t\tcontinue;  \t\t\t\/* Terminate session. *\/ \t\t\tif (fseeko(fp, -(off_t)sizeof(fe), SEEK_CUR) == -1) \t\t\t\terror = errno; \t\t\telse if (fwrite(fu, sizeof(*fu), 1, fp) &lt; 1) \t\t\t\terror = errno; \t\t\telse \t\t\t\tret = 0;  \t\t}  \tfclose(fp); \tif (ret != 0) \t\terrno = error; \treturn (ret); }  static void utx_active_init(const struct futx *fu) { \tint fd;  \t\/* Initialize utx.active with a single BOOT_TIME record. *\/ \tfd = open(_PATH_UTX_ACTIVE, O_CREAT|O_RDWR|O_TRUNC, 0644); \tif (fd &lt; 0) \t\treturn; \twrite(fd, fu, sizeof(*fu)); \tclose(fd); }  static void utx_active_purge(void) {  \ttruncate(_PATH_UTX_ACTIVE, 0); }  static int utx_lastlogin_add(const struct futx *fu) { \tstruct futx fe; \tFILE *fp; \tint error, ret;  \tret = 0;  \t\/* \t * Write an entry to lastlogin.  Overwrite the entry if the \t * current user already has an entry.  If not, append a new \t * entry. \t *\/ \tfp = futx_open(_PATH_UTX_LASTLOGIN); \tif (fp == NULL) \t\treturn (-1); \twhile (fread(&fe, sizeof fe, 1, fp) == 1) { \t\tif (strncmp(fu-&gt;fu_user, fe.fu_user, sizeof fe.fu_user) != 0) \t\t\tcontinue;  \t\t\/* Found a previous lastlogin entry for this user. *\/ \t\tret = fseeko(fp, -(off_t)sizeof fe, SEEK_CUR); \t\tbreak; \t} \tif (ret == -1) \t\terror = errno; \telse if (fwrite(fu, sizeof *fu, 1, fp) &lt; 1) { \t\terror = errno; \t\tret = -1; \t} \tfclose(fp); \tif (ret == -1) \t\terrno = error; \treturn (ret); }  static void utx_lastlogin_upgrade(void) { \tstruct stat sb; \tint fd;  \tfd = open(_PATH_UTX_LASTLOGIN, O_RDWR|O_CLOEXEC, 0644); \tif (fd &lt; 0) \t\treturn;  \t\/* \t * Truncate broken lastlogin files.  In the future we should \t * check for older versions of the file format here and try to \t * upgrade it. \t *\/ \tif (fstat(fd, &sb) != -1 && sb.st_size % sizeof(struct futx) != 0) \t\tftruncate(fd, 0); \tclose(fd); }  static int utx_log_add(const struct futx *fu) { \tstruct iovec vec[2]; \tint error, fd; \tuint16_t l;  \t\/* \t * Append an entry to the log file.  We only need to append \t * records to this file, so to conserve space, trim any trailing \t * zero-bytes.  Prepend a length field, indicating the length of \t * the record, excluding the length field itself. \t *\/ \tfor (l = sizeof(*fu); l &gt; 0 && ((const char *)fu)[l - 1] == '\\0'; l--) ; \tvec[0].iov_base = &l; \tvec[0].iov_len = sizeof(l); \tvec[1].iov_base = __DECONST(void *, fu); \tvec[1].iov_len = l; \tl = htobe16(l);  \tfd = open(_PATH_UTX_LOG, O_CREAT|O_WRONLY|O_APPEND|O_CLOEXEC, 0644); \tif (fd &lt; 0) \t\treturn (-1); \tif (writev(fd, vec, 2) == -1) \t\terror = errno; \telse \t\terror = 0; \tclose(fd); \tif (error != 0) \t\terrno = error; \treturn (error == 0 ? 0 : 1); }  struct utmpx * pututxline(const struct utmpx *utmpx) { \tstruct futx fu; \tint bad;  \tbad = 0;  \tutx_to_futx(utmpx, &fu);  \tswitch (fu.fu_type) { \tcase BOOT_TIME: \t\tutx_active_init(&fu); \t\tutx_lastlogin_upgrade(); \t\tbreak; \tcase SHUTDOWN_TIME: \t\tutx_active_purge(); \t\tbreak; \tcase OLD_TIME: \tcase NEW_TIME: \t\tbreak; \tcase USER_PROCESS: \t\tbad |= utx_active_add(&fu); \t\tbad |= utx_lastlogin_add(&fu); \t\tbreak; #if 0 \/* XXX: Are these records of any use to us? *\/ \tcase INIT_PROCESS: \tcase LOGIN_PROCESS: \t\tbad |= utx_active_add(&fu); \t\tbreak; #endif \tcase DEAD_PROCESS: \t\t\/* \t\t * In case writing a logout entry fails, never attempt \t\t * to write it to utx.log.  The logout entry's ut_id \t\t * might be invalid. \t\t *\/ \t\tif (utx_active_remove(&fu) != 0) \t\t\treturn (NULL); \t\tbreak; \tdefault: \t\terrno = EINVAL; \t\treturn (NULL); \t}  \tbad |= utx_log_add(&fu); \treturn (bad ? NULL : futx_to_utx(&fu)); }  <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  \u0421\u043e\u0431\u0438\u0440\u0430\u0435\u043c  <\/p>\n<pre><code class=\"bash\"># clang getent.c -o gtnt <\/code><\/pre>\n<p>  \u041a\u043e\u043f\u0438\u0440\u0443\u0435\u043c \u0431\u0430\u0437\u044b \u0438 \u043e\u0447\u0438\u0449\u0430\u0435\u043c \u043c\u0435\u0441\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438  <\/p>\n<pre><code class=\"bash\"># cp \/var\/log\/utx.* \/tmp\/ # echo -n &gt; \/var\/log\/utx.log # echo -n &gt; \/var\/log\/utx.lastlogin  <\/code><\/pre>\n<p>  \u0443\u0434\u0430\u043b\u044f\u0435\u043c \u0437\u0430\u043f\u0438\u0441\u0438  <\/p>\n<pre><code class=\"bash\"># .\/gtnt utmpx lastlogin \/tmp\/utx.lastlogin 14281 # .\/gtnt utmpx log \/tmp\/utx.log 14281 <\/code><\/pre>\n<div class=\"spoiler\"><b class=\"spoiler_title\">\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"bash\"># getent utmpx lastlogin getent utmpx lastlogin [1437293217.427108 -- Sun Jul 19 11:06:57 2015] user process: id=&quot;3a873cda545eff7f&quot; pid=&quot;1288&quot; user=&quot;root&quot; line=&quot;ttyv1&quot; host=&quot;&quot; [1447316907.634554 -- Thu Nov 12 11:28:27 2015] user process: id=&quot;8084832f32000000&quot; pid=&quot;4373&quot; user=&quot;Alex&quot; line=&quot;pts\/2&quot; host=&quot;108.182.182.209&quot; [1412600841.811588 -- Mon Oct  6 16:07:21 2014] user process: id=&quot;3962386266747064&quot; pid=&quot;39819&quot; user=&quot;swimmer&quot; line=&quot;ftpd&quot; host=&quot;10.34.1.23&quot;   # getent utmpx log getent utmpx log [1446494176.682516 -- Mon Nov  2 22:56:16 2015] user process: id=&quot;8084832f32000000&quot; pid=&quot;72946&quot; user=&quot;Alex&quot; line=&quot;pts\/2&quot; host=&quot;108.182.182.209&quot; [1446498691.474026 -- Tue Nov  3 00:11:31 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;61263&quot; [1446614492.857275 -- Wed Nov  4 08:21:32 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;79491&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;30.205.96.92&quot; [1446614507.736041 -- Wed Nov  4 08:21:47 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;79491&quot; [1446698146.439426 -- Thu Nov  5 07:35:46 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;83858&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;30.205.116.124&quot; [1446706228.892627 -- Thu Nov  5 09:50:28 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;83858&quot; [1446710834.014993 -- Thu Nov  5 11:07:14 2015] system shutdown [1446710906.311914 -- Thu Nov  5 11:08:26 2015] system boot [1446710938.817058 -- Thu Nov  5 11:08:58 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;1313&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;10.3.1.15&quot; [1446721174.063221 -- Thu Nov  5 13:59:34 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;1789&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;108.182.182.209&quot; [1446815955.085182 -- Fri Nov  6 16:19:15 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;1313&quot; [1446906334.551710 -- Sat Nov  7 17:25:34 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;11580&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;108.182.182.209&quot; [1446912588.809728 -- Sat Nov  7 19:09:48 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;1789&quot; [1447045707.708080 -- Mon Nov  9 08:08:27 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;19008&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;mm-21-205-84-93.dynamic.pppoe.mgts.ru&quot; [1447045911.315244 -- Mon Nov  9 08:11:51 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;19008&quot; [1447052181.641530 -- Mon Nov  9 09:56:21 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;19314&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;10.3.1.15&quot; [1447131335.768107 -- Tue Nov 10 07:55:35 2015] user process: id=&quot;8084832f33000000&quot; pid=&quot;23441&quot; user=&quot;Alex&quot; line=&quot;pts\/3&quot; host=&quot;30.205.98.54&quot; [1447133646.400779 -- Tue Nov 10 08:34:06 2015] dead process: id=&quot;8084832f33000000&quot; pid=&quot;23441&quot; [1447261331.491910 -- Wed Nov 11 20:02:11 2015] system boot [1447263839.850262 -- Wed Nov 11 20:43:59 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;1422&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;10.3.1.15&quot; [1447267906.123055 -- Wed Nov 11 21:51:46 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;1644&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;10.3.1.15&quot; [1447271644.777315 -- Wed Nov 11 22:54:04 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;1422&quot; [1447275711.000315 -- Thu Nov 12 00:01:51 2015] dead process: id=&quot;8084832f31000000&quot; pid=&quot;1644&quot; [1447303224.172811 -- Thu Nov 12 07:40:24 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;3685&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;30.205.135.101&quot; [1447305113.718172 -- Thu Nov 12 08:11:53 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;3685&quot; [1447309547.097136 -- Thu Nov 12 09:25:47 2015] user process: id=&quot;8084832f30000000&quot; pid=&quot;4018&quot; user=&quot;Alex&quot; line=&quot;pts\/0&quot; host=&quot;108.182.182.209&quot; [1447311304.396008 -- Thu Nov 12 09:55:04 2015] user process: id=&quot;8084832f31000000&quot; pid=&quot;4104&quot; user=&quot;Alex&quot; line=&quot;pts\/1&quot; host=&quot;10.3.1.15&quot; [1447316907.634554 -- Thu Nov 12 11:28:27 2015] user process: id=&quot;8084832f32000000&quot; pid=&quot;4373&quot; user=&quot;Alex&quot; line=&quot;pts\/2&quot; host=&quot;108.182.182.209&quot; [1447322795.387121 -- Thu Nov 12 13:06:35 2015] dead process: id=&quot;8084832f30000000&quot; pid=&quot;4018&quot;  <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  \u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e  <\/p>\n<pre><code class=\"bash\"># lastlogin lastlogin Alex       pts\/2    108.182.182.209        Thu Nov 12 11:28:27 2015 root       ttyv1                           Sun Jul 19 11:06:57 2015 swimmer    ftpd     10.34.1.23             Mon Oct  6 16:07:21 2014  <\/code><\/pre>\n<p>  \u0412\u0441\u0435 \u044d\u0442\u0438 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u0432\u0435\u043b\u0438 \u043a   <\/p>\n<pre><code class=\"bash\"># ls -l \/var\/log\/utx.log ls -l \/var\/log\/utx.log -rw-r--r--  1 root  wheel  1570 Nov 13 14:28 \/var\/log\/utx.log  <\/code><\/pre>\n<p>  \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u0443\u0435\u043c \u0432\u0440\u0435\u043c\u044f \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u044f \u0432 \u0441\u043e\u043e\u0442\u0432\u0442\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0432 \u043b\u043e\u0433\u0435  <\/p>\n<pre><code class=\"bash\"># touch -t201511121306 \/var\/log\/utx.log touch -t201511121306 \/var\/log\/utx.log # ls -l \/var\/log\/utx.log ls -l \/var\/log\/utx.log -rw-r--r--  1 root  wheel  1570 Nov 12 13:06 \/var\/log\/utx.log <\/code><\/pre>\n<p>  \u041f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c \u0442\u043e \u0436\u0435 \u0434\u043b\u044f \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432\u2026<\/p>\n<p>  \u0414\u0435\u043b\u043e \u0441\u0434\u0435\u043b\u0430\u043d\u043e, \u043f\u043e\u0440\u0430 \u0443\u0445\u043e\u0434\u0438\u0442\u044c. \u0427\u0438\u0441\u0442\u0438\u043c \u0438\u0441\u0442\u043e\u0440\u0438\u044e   <\/p>\n<pre><code class=\"bash\"># history -c  <\/code><\/pre>\n<p>  \u0438 \u0443\u0445\u043e\u0434\u0438\u043c \u00ab\u043f\u043e \u0430\u043d\u0433\u043b\u0438\u0439\u0441\u043a\u0438\u00bb  <\/p>\n<pre><code class=\"bash\"># kill -9 $$ <\/code><\/pre>\n<p>  \u041a \u0447\u0435\u043c\u0443 \u0432\u0441\u0451 \u0432\u044b\u0448\u0435\u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u0435? <br \/>  \u041d\u0435 \u043f\u043e\u043b\u0430\u0433\u0430\u0439\u0442\u0435\u0441\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043b\u043e\u0433\u0438, \u0432\u0435\u0434\u0438\u0442\u0435 \u0441\u0432\u043e\u0438. \u0425\u043e\u0442\u044f \u0431\u044b \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043d\u0430 e-mail \u043e \u0432\u0445\u043e\u0434\u0435.               <\/p>\n<div class=\"clear\"><\/div>\n<p> \u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438 <a href=\"http:\/\/habrahabr.ru\/post\/270801\/\"> http:\/\/habrahabr.ru\/post\/270801\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>       \u0422\u044f\u043f\u043d\u0438\u0446\u0430\u2026 \u0442\u0440\u0438\u043d\u0430\u0434\u0446\u0430\u0442\u043e\u0435\u2026 \u0432\u0441\u0451 \u0432\u0430\u0436\u043d\u043e\u0435 \u0440\u0435\u0448\u0438\u043b\u0438 \u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043d\u0430 \u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a, \u0430 \u043f\u043e\u0442\u043e\u043c\u0443 \u0441\u0434\u0435\u043b\u0430\u044e \u043a\u0430\u043a\u0443\u044e-\u043d\u0438\u0431\u0443\u0434\u044c \u0433\u0430\u0434\u043e\u0441\u0442\u044c\u2026<br \/>  \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u043f\u043e\u044f\u0432\u0438\u0432\u0438\u0448\u0438\u043c\u0441\u044f \u043d\u0430 <a href=\"http:\/\/habrahabr.ru\/company\/ua-hosting\/blog\/270687\/\">\u0445\u0430\u0431\u0440\u0435 <\/a>\u043f\u0435\u0440\u0435\u0441\u043a\u0430\u0437\u043e\u043c <a href=\"http:\/\/www.itworld.com\/article\/2914650\/linux\/checking-last-logins-with-lastlog.html\">\u0441\u0442\u0430\u0442\u044c\u0438<\/a> \u0440\u0435\u0448\u0438\u043b \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e\u0442\u0431\u0430\u043b\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u043e\u0435 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e. \u0421\u043a\u0440\u044b\u0442\u044c \u0441\u0432\u043e\u0451 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0435, \u043a\u043e\u043d\u0435\u0447\u043d\u043e, \u043d\u0435 \u0441\u043e\u0432\u0441\u0435\u043c \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u043e, \u043d\u043e \u043e\u0441\u043e\u0431\u044b\u0445 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439 \u044d\u0442\u043e \u043d\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442. <br \/>  \u0418\u0442\u0430\u043a, \u0437\u0430\u0434\u0430\u0447\u0430:<br \/>  \u0412\u043e\u0439\u0442\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043d\u0435\u043a\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0438 \u00ab\u043f\u043e\u0434\u043c\u0435\u0441\u0442\u0438\u00bb \u0437\u0430 \u0441\u043e\u0431\u043e\u0439.<\/p>\n<p>  \u0417\u0434\u0435\u0441\u044c \u0438 \u0434\u0430\u043b\u0435\u0435 \u0441\u0447\u0438\u0442\u0430\u0435\u043c, \u0447\u0442\u043e \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0441\u043b\u0435\u0436\u0435\u043d\u0438\u044f( \u0437\u0430 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u00ab\u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e\u00bb) \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0438 \u043c\u044b \u0437\u043d\u0430\u0435\u043c \u043f\u0430\u0440\u043e\u043b\u044c root&#8217;a.<br \/>  <img decoding=\"async\" align=\"right\" width=\"50%\" src=\"https:\/\/habrastorage.org\/files\/390\/73c\/459\/39073c45922649a58baa934317068359.png\"\/><br \/>  \u0421 \u0447\u0435\u043c \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u043c:<\/p>\n<pre><code class=\"bash\"># uname -ori FreeBSD 10.0-RELEASE GENERIC <\/code><\/pre>\n<p>  <\/p>\n<pre><code class=\"bash\"># `echo $SHELL` --version tcsh 6.18.01 (Astron) <\/code><\/pre>\n<p>  \u041e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c\u043e\u0435 \u043d\u0438\u0436\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u0438\u0441\u0441\u043e\u043d\u0438\u0440\u0443\u0435\u0442 \u0441 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u043c\u043e\u0439 \u0432\u044b\u0448\u0435 \u0441\u0442\u0430\u0442\u044c\u0435\u0439, \u0442.\u043a. \u043e\u043d\u0430\u044f \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043e\u0440\u0438\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 Linux-\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043d\u043e \u043e\u0431\u0449\u0438\u0435 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u044b \u0442\u0435\u0436\u0435 \u0438 \u043f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u0432\u043e FreeBSD(c 9.0) \u043d\u0430 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 utmpx \u0440\u043e\u0434\u0441\u0442\u0432\u043e \u0441\u0442\u0430\u043b\u043e \u0431\u043b\u0438\u0436\u0435.<\/p>\n<p>  \u041f\u043e\u0435\u0445\u0430\u043b\u0438\u2026  <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-268170","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/268170","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=268170"}],"version-history":[{"count":0,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/268170\/revisions"}],"wp:attachment":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=268170"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=268170"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=268170"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}