How should timestamps in last output be interpreted on linux?

Question

$ last -aid
foouser  pts/12       Sun Feb 15 07:30 - 15:23 (2+07:52)     XXX.YYY.ZZZ.QQQ

The Sun Feb 15 07:30 - 15:23 part is pretty obvious. The user logged in at 7:30 on Sunday. But (2+07:52) is unclear. 7:52 is the difference between the two times, but what's the 2+ part?

Answer 1

Those might be days but I'm not sure; also this is not a programming question.

Answer 2

Use the source, Luke:

sprintf(length, "(%d+%02d:%02d)", days, hours, mins);

This is from the sysvinit source package on Debian.

Hint for those without knowledge in C: it's the number of days.

Answer 3

The string between the parentheses is the duration of the session. As you note, the time is the difference between the end and start times. The 2+ is the number of days as hop noted.

At some point, this question probably should be moved over to Server Fault since it's most likely to be of interest to System Administrators.

It's a fairly readable format once you know what you are looking at. If I were designing the output, I think I'd make the day of the week optional and put the entire end date in the string instead. Even better would be to let the date stamp be configurable. That way, the output could be more easily used by another program.

The actual duration, if the user has logged out of the session is fairly easy to pick out with a regular expression:

$ last | perl -lne 'print "$2 days, $3 hours, $4 minutes" if /\(((\d+)\+)(\d{2}):(\d{2})\)$/'
17 days, 05 hours, 23 minutes
3 days, 23 hours, 16 minutes
14 days, 06 hours, 09 minutes
23 days, 04 hours, 54 minutes
16 days, 06 hours, 57 minutes
...