Looking at user login time with the ac command

The ac command can provide very useful summaries of how much time users spend logged into a Linux system. It gets its data from the wtmp file.

Gaming keyboard keys, green

While not a very well known Linux command, ac can provide very useful stats on user login time. In its simplest form, it will show you how much time users have spent on the system in the time period covered by the wtmp file. All you have to type is “ac” to get a figure showing overall login time for all users.

$ ac
        total     8360.60

The figure above indicates that users spent a total of 8,360.6 hours on the system. Looking at the wtmp file with the who command, we can see that the saved logins started on June 6th – a little more than 6 months earlier.

$ who /var/log/wtmp | head -2
shs      tty2         2022-06-06 16:00 (tty2)
shs      pts/1        2022-06-06 16:23 (

To look at the times by user, add the -p (people) argument.

$ ac -p
        popeye                            1081.10
        nemo                              2301.70
        shark                              801.00
        shs                               4176.80
        total     8360.6

To look at daily login totals, you can use the ac -d (day) command. Add a grep command if you only want to see login times for one month.

$ ac -d | grep Oct | head -11
Oct  1  total       46.21
Oct  2  total       55.09
Oct  3  total       34.50
Oct  4  total       69.48
Oct  5  total       50.73
Oct  6  total       44.85
Oct  7  total       25.05
Oct  8  total       74.49
Oct  9  total       44.88
Oct 10  total       34.28
Oct 11  total       38.36

Piping the output of the ac -d command to the head command is another way to see how far back the wtmp file goes.

$ ac -d | head -1
Jun  6  total       82.92

You can also pipe the ac output to the tail command to see the most recent days. This provides the current day as well as earlier days in the month.

$ ac -d | tail -10
Nov  1  total      121.79
Nov  2  total       24.86
Nov  3  total       25.75
Nov  4  total       24.63
Nov  5  total       25.03
Nov  7  total       52.97
Nov  8  total       26.86
Nov  9  total       27.66
Nov 10  total       24.56
Today   total       14.91

If you have wtmp data from some other time period or system saved in a file, you can run an ac command against that file like this:

$ ac -f /var/log/Jupiter
        total     5434.7

The ac -h (help) command will provide a summary of the command’s many options.

$ ac -h

Usage: ac [OPTION] ...

  -d, --daily-totals        Print totals for each day
  -p, --individual-totals   Print time totals for each user
  -f, --file  <file>         Read from  <file>
  --complain                Print errors for whatever problem
  --reboots                 Count the time between login and reboot
  --supplants               Count the time between logins on the terminal
  --timewarps               Count the time between login and time warp
  --compatibility           Shortcut for --reboots --supplants --timewarps
  -a, --all-days            Do not skip days without login activity
  --tw-leniency  <value>     Set the time warp leniency  <value> in seconds
  --tw-suspicious  <value>   Set the time warp suspicious  <value> in seconds
  --print-year              Print year when displaying dates
  --print-zeros             Don't suppress zeros in category totals
  --debug                   Print verbose internal information
  -V, --version             Show version and exit
  -h, --help                Show help and exit

The system's default login accounting file is /var/log/wtmp. While the ac command's summaries are generally more useful, you can view every entry in that file if you see the need. Use the who /var/log/wtmp command as shown below. Piping its output to the more command will allow you to slowly move through the details and get a feel for how much and how often the particular system is being used.

$ who /var/log/wtmp | more
shs      pts/1        2022-06-07 06:40 (
shs      pts/2        2022-06-07 08:26 (
shark    pts/3        2022-06-07 09:00 (
nemo     pts/2        2022-06-07 10:09 (
nemo     pts/2        2022-06-07 11:05 (
nemo     pts/2        2022-06-07 12:12 (
shs      pts/2        2022-06-07 13:50 (
nemo     pts/2        2022-06-07 14:15 (
shs      pts/1        2022-06-06 16:23 (
shs      tty2         2022-06-06 16:00 (tty2)
shs      pts/1        2022-06-06 17:32 (
shs      tty2         2022-06-06 17:17 (tty2)
shs      tty2         2022-06-06 17:21 (tty2)
shs      pts/1        2022-06-06 18:35 (
shark    pts/2        2022-06-07 18:26 (


The ac command makes information stored in the wtmp file more accessible. If you want to know how much time users spend logged into a system or how often they log in, it’s just what you need. Likely standing for “accounting”, the ac command allows you to view data in the wtmp file in several very useful ways.


Copyright © 2022 IDG Communications, Inc.

The 10 most powerful companies in enterprise networking 2022