#!/usr/bin/gawk -f
#
function progname() { return "last-filter" }
function progvers() { return "2006-09-22a" }
function proghome() { return "<http://bugsplatter.id.au/awk/>" }
#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
# last-filter
# ````````````
# awk program to filter and format output from the 'last -adx' command to 
#  display user login date/time, and system reboot/shutdown information
#
# Copyright (C) 2006 Grant Coady <grant@bugsplatter.id.au> GPLv2
# 
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License.
#
#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
# usage
# ``````
# Note: `tac` is used to get ascending date order
#
# examples
# `````````
# ~$ last -adx| tac| last-filter
#
# ~$ last -adx| tac| grep "Aug  2"| last-filter
#
# ~$ last -adx| tac| datestamp-filter -v hours=12 datecolm=44| last-filter
#
#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
# option	description					default
# ------------	----------------------------------------------	--------
# -v verbose=1	print version					0
#
# reference:
#	http://www.gnu.org/software/gawk/manual/

#### setup 'last -x' parser ###################################################

BEGIN {
	if (verbose)
		printf "\n%s %s %s\n\n", progname(), progvers(), proghome()

	datecolm = 27			# start of date / time info

	# first column label, keep them the same size
	system_event =	"- - -"
	login_user =	"login"
	login_ftp = 	"-ftp-"

	outformat = "%-9s %-16s %s\n"	# set output display format
}

#### run 'last -x' parser #####################################################

/^$/ { next }				# ignore blank lines

{ user = $1; f2 = $2; f3 = $3 }

user ~ /wtmp/ { next }			# ignore wtmp

{ datetime = substr($0, datecolm) }	# grab record's date / time info

user ~ /runlevel/ { next }		# ignore runlevel pseudo-user

# handle reboot and shutdown pseudo-users
user ~ /reboot|shutdown/ {
	printf outformat, system_event, $2 " " $3, datetime
	next
}

# handle ftp login
user ~ /ftp/ {
	printf outformat, login_ftp, $3, datetime
	next
}

# default
{
	printf outformat, login_user, $1, datetime
}
# end