自动记录登录注销时间脚本

wen 实用脚本 2026-07-30 3

本文目录导读：

自动记录登录注销时间脚本

Windows 版本 (PowerShell脚本)
Linux 版本 (Bash脚本)
跨平台解决方案 (Python脚本)
使用说明
日志格式示例

Windows 版本 (PowerShell脚本)

基础日志记录脚本

# AutoLogTracker.ps1
$logFile = "C:\Logs\UserActivity_$env:COMPUTERNAME.log"
$logDir = Split-Path $logFile -Parent
# 创建日志目录
if (!(Test-Path $logDir)) {
    New-Item -ItemType Directory -Path $logDir -Force
}
function Write-Log {
    param([string]$Event, [string]$User)
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $logEntry = "$timestamp | $env:COMPUTERNAME | $User | $Event"
    Add-Content -Path $logFile -Value $logEntry
}
# 记录登录事件
$currentUser = [System.Environment]::UserName
Write-Log -Event "LOGIN" -User $currentUser
# 注册注销事件
Register-EngineEvent -SourceIdentifier PowerShell.Exiting -Action {
    param($event)
    $logFile = "C:\Logs\UserActivity_$env:COMPUTERNAME.log"
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $logEntry = "$timestamp | $env:COMPUTERNAME | $env:USERNAME | LOGOUT"
    Add-Content -Path $logFile -Value $logEntry
}

通过任务计划程序自动运行

创建启动脚本 (StartLogTracker.bat)：

@echo off
powershell.exe -ExecutionPolicy Bypass -File "C:\Scripts\AutoLogTracker.ps1"

设置任务计划：

# 以管理员身份运行
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ExecutionPolicy Bypass -File C:\Scripts\AutoLogTracker.ps1"
$trigger = @(
    @{UserId="NT AUTHORITY\SYSTEM"; LogonType=5},
    @{UserId="NT AUTHORITY\SYSTEM"; LogonType=6}
)
Register-ScheduledTask -TaskName "AutoLogTracker" -Action $action -Trigger $trigger -RunLevel Highest

Linux 版本 (Bash脚本)

使用系统日志的监控脚本

#!/bin/bash
# auto_log_tracker.sh
LOG_FILE="/var/log/user_activity_$(hostname).log"
LAST_LOGIN_FILE="/tmp/last_login_check"
# 确保日志目录存在
sudo touch $LOG_FILE
sudo chmod 644 $LOG_FILE
# 初始化检查点
if [ ! -f $LAST_LOGIN_FILE ]; then
    echo "0" | sudo tee $LAST_LOGIN_FILE > /dev/null
fi
# 监控登录/注销事件
function monitor_user_activity() {
    # 读取上次检查的时间戳
    last_check=$(cat $LAST_LOGIN_FILE)
    # 检查login记录 (utmp/wtmp)
    last -f /var/log/wtmp | awk -v last_check="$last_check" '
    {
        if ($0 ~ /^[a-zA-Z]/ && $0 !~ /^reboot|^shutdown|^wtmp/) {
            print strftime("%Y-%m-%d %H:%M:%S") " | " strftime("%s") " | " $1 " | LOGIN"
        }
    }'
    # 更新检查点
    date +%s | sudo tee $LAST_LOGIN_FILE > /dev/null
}
# 实时监控 (使用auditd)
function realtime_monitor() {
    # 使用inotify监控utmp文件变化
    while true; do
        inotifywait -e modify /var/run/utmp 2>/dev/null
        monitor_user_activity >> $LOG_FILE
    done
}
# 运行监控
case "$1" in
    start)
        echo "Starting user activity monitoring..."
        monitor_user_activity >> $LOG_FILE
        realtime_monitor &
        echo $! > /tmp/auto_log_tracker.pid
        ;;
    stop)
        echo "Stopping monitoring..."
        if [ -f /tmp/auto_log_tracker.pid ]; then
            kill $(cat /tmp/auto_log_tracker.pid) 2>/dev/null
            rm -f /tmp/auto_log_tracker.pid
        fi
        ;;
    status)
        if [ -f /tmp/auto_log_tracker.pid ] && kill -0 $(cat /tmp/auto_log_tracker.pid) 2>/dev/null; then
            echo "Monitoring is running"
        else
            echo "Monitoring is not running"
        fi
        ;;
    *)
        echo "Usage: $0 {start|stop|status}"
        ;;
esac

使用systemd的登录跟踪

创建systemd服务 (/etc/systemd/system/user-activity-tracker.service)：

[Unit]
Description=User Activity Logging Service
After=network.target
[Service]
Type=simple
ExecStart=/usr/local/bin/auto_log_tracker.sh start
ExecStop=/usr/local/bin/auto_log_tracker.sh stop
Restart=always
User=root
[Install]
WantedBy=multi-user.target

启用服务：

sudo systemctl daemon-reload
sudo systemctl enable user-activity-tracker.service
sudo systemctl start user-activity-tracker.service

跨平台解决方案 (Python脚本)

创建一个跨平台的Python脚本 user_tracker.py：

#!/usr/bin/env python3
import os
import sys
import time
import psutil
import logging
from datetime import datetime
import platform
import subprocess
class UserActivityTracker:
    def __init__(self, log_file=None):
        if log_file is None:
            log_file = f"/var/log/user_activity_{platform.node()}.log" if platform.system() != "Windows" \
                      else f"C:\\Logs\\user_activity_{platform.node()}.log"
        self.log_file = log_file
        self.setup_logging()
        self.previous_users = set()
    def setup_logging(self):
        os.makedirs(os.path.dirname(self.log_file), exist_ok=True)
        logging.basicConfig(
            filename=self.log_file,
            level=logging.INFO,
            format='%(asctime)s | %(message)s',
            datefmt='%Y-%m-%d %H:%M:%S'
        )
        self.logger = logging.getLogger(__name__)
    def get_active_users(self):
        """获取当前活动用户"""
        users = set()
        if platform.system() == "Windows":
            import win32api
            import win32security
            try:
                # 使用Windows API获取登录用户
                for session in win32api.EnumLogonSessions():
                    for info in win32api.EnumLogonSessions(session):
                        if info:
                            users.add(str(info[0]))
            except:
                pass
        else:
            # Linux系统
            try:
                result = subprocess.run(['who', '-u'], capture_output=True, text=True)
                for line in result.stdout.split('\n'):
                    if line.strip():
                        parts = line.split()
                        if len(parts) > 0:
                            users.add(parts[0])
            except:
                pass
        return users
    def track_users(self):
        """跟踪用户登录/注销"""
        current_users = self.get_active_users()
        # 检查登录事件
        new_users = current_users - self.previous_users
        for user in new_users:
            self.logger.info(f"{user} | LOGIN")
            print(f"[{datetime.now()}] {user} 登录")
        # 检查注销事件
        logged_out_users = self.previous_users - current_users
        for user in logged_out_users:
            self.logger.info(f"{user} | LOGOUT")
            print(f"[{datetime.now()}] {user} 注销")
        self.previous_users = current_users
    def run(self, interval=5):
        """主循环"""
        print(f"开始监控用户活动 (间隔: {interval}秒)")
        print(f"日志文件: {self.log_file}")
        try:
            while True:
                self.track_users()
                time.sleep(interval)
        except KeyboardInterrupt:
            print("\n停止监控...")
if __name__ == "__main__":
    tracker = UserActivityTracker()
    tracker.run(interval=10)

安装依赖：

pip install psutil pywin32  # Windows需要pywin32

使用说明

Windows部署：

以管理员身份运行PowerShell
执行基础脚本或设置任务计划
查看 C:\Logs\UserActivity_*.log

Linux部署：

给予脚本执行权限：chmod +x auto_log_tracker.sh
创建systemd服务或直接运行：./auto_log_tracker.sh start
查看 /var/log/user_activity_*.log

Python版本：

# 运行
python3 user_tracker.py
# 查看日志
tail -f /var/log/user_activity_*.log  # Linux
type C:\Logs\user_activity_*.log       # Windows

日志格式示例

2024-01-15 08:30:00 | server01 | john | LOGIN
2024-01-15 12:00:00 | server01 | john | LOGOUT
2024-01-15 13:00:00 | server01 | jane | LOGIN

这些脚本会自动记录所有用户的登录和注销事件,并保存到指定的日志文件中，您可以根据需要调整监控间隔和日志路径。