errors using 'who' command

[jlaw10]

Attempting to monitor root access w/ the following command -

http://adminlinux.blogspot.com/2007/10/system-security-monitor-root-access.html:

[root@prematics32 ~]# echo 'ALERT - Root Shell Access on:' `date` `who` mail -s "Alert: Root Access from `who cut -d"(" -f2 cut -d")" -f1`" user@example.com

Receive the following error:
who: invalid option -- (
Try `who --help' for more information.
ALERT - Root Shell Access on: Fri Aug 20 13:28:45 EDT 2010 micore pts/1 Aug 20 11:03 (172.16.192.82) mail -s Alert: Root Access from user@example.com

Does anyone know what 'who' parameter is triggering this error and what the proper syntax should be?

 

[ZaSter]

It looks like your commands are strung together. Instead of "who cut -d", try for example, "who | cut -d" etc.

 

[BadBigBen]

instead of

who cut -d"(" -f2 cut -d")" -f1

use

who cut -d -f1 or who cut -f2 cut -d -f1

the "(" & ")" are optional parameters, those that are between them.

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[jlaw10]

Still receive same errors w/ all recommended options:

[root@prematics31 ~]# echo 'ALERT - Root Shell Access on:' `date` `who` mail -s "Alert: Root Access from `who cut -d -f1`" jason.outlaw@micoresolutions.com
who: invalid option -- f
Try `who --help' for more information.
ALERT - Root Shell Access on: Sun Aug 22 09:34:13 EDT 2010 micore pts/1 Aug 22 09:31 (172.16.200.90) mail -s Alert: Root Access from jason.outlaw@micoresolutions.com
[root@prematics31 ~]# echo 'ALERT - Root Shell Access on:' `date` `who` mail -s "Alert: Root Access from `who cut -f2 cut -d -f1`" jason.outlaw@micoresolutions.com
who: invalid option -- f
Try `who --help' for more information.
ALERT - Root Shell Access on: Sun Aug 22 09:34:42 EDT 2010 micore pts/1 Aug 22 09:31 (172.16.200.90) mail -s Alert: Root Access from jason.outlaw@micoresolutions.com


[root@prematics31 ~]# echo 'ALERT - Root Shell Access on:' `date` `who` mail -s "Alert: Root Access from `who | cut -d"(" -f2 cut -d")" -f1`" jason.outlaw@micoresolutions.com
cut: only one type of list may be specified
Try `cut --help' for more information.
ALERT - Root Shell Access on: Sun Aug 22 09:35:46 EDT 2010 micore pts/1 Aug 22 09:31 (172.16.200.90) mail -s Alert: Root Access from jason.outlaw@micoresolutions.com

 

[Annihilannic]

I think you're following bad advice there in the first place; the output of those commands is going to be a complete mess by the time it makes it into an email anyway, especially when there are multiple users logged on to the system (i.e. multiple lines of who output all squashed up on one line).

I would rearrange it like this:

(
        echo "ALERT - Root Shell Access on: $(date)"
        echo
        who
) | mail -s "Alert: Root Access from $(who am i | cut -f2 -d'(' | cut -f1 -d ')')" jason.outlaw@example.com
)

Annihilannic.

 

[jlaw10]

Annihilannic...the email output is perfect just one small detail and then this issue will be closed. I still received this error at at the command line (despite email results as expected):

[root@prematics32 ~]# )
-bash: syntax error near unexpected token `)'

 

[m4ilm4n]

Try this -

echo "ALERT - Root Shell Access on: $(date)"
        echo
        who | mail -s "Alert: Root Access from $(who am i | cut -f2 -d'(' | cut -f1 -d ')')" jason.outlaw@example.com

 

[Annihilannic]

Or just remove the extra ")" at the very end of the script... not sure where I got that one from!

Annihilannic.