Subject: Re: How to determine which Mac s are connected?

From: [email-masked]
Date: Thu, 23 Mar 2000 10:02:47 -0500

Patrik Schindler, [email-masked] writes:

>Indeed, a little goodie to keep track which users were connected from 
>which machines would be nice, but I have no idea to keep track of 
>AppleTalk users.
>
>Only afpd knows which childs he forks. Perhaps this is one point: Register 
>some kind of file in /proc/sys (what about the /proc structure within 
>Solaris?)...

We use "ps".  Doing a 'ps aux|grep afp' will give you a list of all the 
afp processes.  The one owned by "root" is the original.  All the others 
are owned by the login id of the user.  To track down machines, you have 
to go to the log file: /var/log/messages

  sudo grep afp /var/log/messages

will list out everything, including the process ID.  With a little 
scripting, it would be possible to "join" the two together by process ID, 
thus matching user with machine.  Hmmmm....maybe I'll write it and donate 
it to the list.

---
Jim Hart
"Organization is necessary for things to exist; Chaos is necessary for 
things to evolve."

---

From: clyde jones <[email-masked]>
Date: Thu, 23 Mar 2000 11:35:43 -0500

>thus matching user with machine.  Hmmmm....maybe I'll write it and donate

Someone already did that - I have a nice little script that someone I 
don't remember contributed-
Would the responsible party please stand up and be acknowledged.
just dump this into a file, and chmod a+x and it runs, you may have 
to fiddle with the cut to make it nice for your own system.

#begin netatalk--cut here
echo
echo "                          NetATalk"
echo "                          --------"
ps axuw|grep atalkd|grep root|grep -v grep|sort|cut -c 1-15,41-160
ps axuw|grep afp   |grep root|grep -v grep|sort|cut -c 1-15,41-160
ps axuw|grep papd  |grep root|grep -v grep|sort|cut -c 1-15,41-160
echo "                "

echo "Clients     PID Status   Start        Binary"
echo "---------------------------------------------------------------------"
ps axuw|grep afp  |grep -v root|grep -v grep|sort|cut -c 1-15,41-160
echo
echo "
- ---------------------------------------------------------------------"

#end -cut here
-- 
Pray to God, But Hammer Away
     - Spanish Proverb
           Clyde Jones

Clyde Jones
Http://www.geocities.com/clyde-jones -- mailto:[email-masked]
Cell 443.226.6054

__________________________________________________
Do You Yahoo!?
Talk to your friends online with Yahoo! Messenger.
http://im.yahoo.com

---

From: Patrik Schindler <[email-masked]>
Date: Thu, 23 Mar 2000 17:49:45 +0100

>  sudo grep afp /var/log/messages

This is bad, because it relies on an existing syslog.

:wq! PoC

---

From: Tom Fitzgerald <[email-masked]>
Date: Thu, 23 Mar 2000 15:54:30 -0500

> thus matching user with machine.  Hmmmm....maybe I'll write it and donate 

Here's what I use on Solaris.  It depends on /var/log/syslog having all
afpd log info (so when the syslog gets truncated, the info becomes
unreliable, but oh well).

Output looks like:

# atwho
    USER    GROUP   PID  RSS    STIME        TIME CMD     HOST
 susanrm      mit 25601  940   Mar_20        0:25 afpd    lycra
 namkung      mit 10641  852   Mar_22        0:02 afpd    scanmac-116
 h_chang      mit 16964  864 19:31:26        0:00 afpd    eastgate-four
 susanrm      mit  2621  904 13:56:31        0:00 afpd    cro-g4
   jmack      mit  1959 1028 13:29:12        0:02 afpd    fredrik
(etc)

all fields except the last are from ps(1), so RSS is process memory
size in KB, STIME is process start time, etc.

-------------------------- cut here --------------------------
#!/usr/local/bin/perl

use Socket;

%ip = ();		# indexed by pid: IP address of client
%user = ();		# and user logged in on that client

open (LOG, "/var/log/syslog") || die "Can't open syslog: $!";
while (<LOG>) {
    next unless / afpd\[.*( login | logout | session| server_child)/;
    @a = split (' ');
    ($pid = $a[4]) =~ s/^afpd\[(.*)\]:$/$1/;
    if ($a[6] =~ /^session:/) {
        ($ip = $a[8]) =~ s/:.*//;
        $ip {$pid} = $ip;
    } elsif ($a[5] eq "login") {
        $user {$pid} = $a[6];
    } elsif ($a[5] eq "logout") {
        delete $ip {$pid};
        delete $user {$pid};
    } elsif ($a[5] =~ /^server_child/) {
        $pid = $a[6];
        delete $ip {$pid};
        delete $user {$pid};
    }
}
close LOG;

open (PS, "ps -ae -o user,group,pid,rss,stime,time,fname|")
   || die "Can't fork ps: $!";

$_ = <PS>;
chop;
printf "%-57s %s\n", $_, "HOST";
while (<PS>) {
    next if /^    root / || !/afpd$/;
    chop;
    @a = split(' ');
    $pid = $a[2];
    $packip = pack ('C4', split (/\./, $ip{$pid}));
    ($name, $rest) = gethostbyaddr ($packip, AF_INET);
    printf "%-57s %s\n", $_, $name;
}
close PS;