User login data acquisition method and device
Through binary mode analysis and multi-threaded parallel processing of wtmp files, the problems of low efficiency and poor platform compatibility of traditional users' login data acquisition solutions are solved, and fast and accurate data acquisition is achieved, which is suitable for most Linux distributions.
Patent Information
- Application Number
- CN202411145452.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-20
- Publication Date
- 2024-12-31
AI Technical Summary
Traditional user login data acquisition solutions are inefficient and poor platform compatibility, resulting in untimely data recording and complex analysis implementation, and rely on design differences in specific Linux distributions.
Use binary mode to open the system's wtmp file, parse it one by one and convert it to a readable format, use multi-threaded parallel parsing to improve efficiency, and store data through bit domains to reduce memory usage, adapting to most Linux distributions.
It realizes faster and more accurate user login data collection, avoids the analysis complexity caused by design differences between different distributions, and improves the speed and efficiency of data parsing.
Smart Images
Figure CN119226076A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of data collection, and in particular to a method and device for collecting user login data. Background Art
[0002] In the field of data collection, the collection of user data is a basic requirement. We must ensure both the accuracy of the data and the efficiency of collection.
[0003] For the data collection related to user login information, the traditional solution adopts audit log analysis or command output analysis. In the process of studying related technologies, the inventor found that the traditional solution has the following problems:
[0004] 1. Low efficiency: Whether it is the parsing of the audit.log file or the parsing of the last command result, there is the processing of large text data and the matching of complex text formats. The acquired data will contain a certain amount of invalid data or noise data, and a complex data cleaning is required to obtain usable data. This process takes a certain amount of time and requires complex data processing.
[0005] 2. Poor platform compatibility: Different Linux distributions have more or less design differences, which leads to differences in the storage location of specific files and partial differences in the format of command output. This results in the same implementation not being fully available on different distributions, which increases the workload. Even if more versions of distributions are adapted, there may still be incompatibility between some distributions.
[0006] Therefore, traditional data analysis solutions have problems such as untimely data recording, complex analysis implementation, and strong platform dependence. Summary of the invention
[0007] The present invention aims to at least solve the technical problems existing in the prior art. To this end, the first aspect of the present invention provides a method for collecting user login data, the method comprising:
[0008] Open the system's wtmp file in binary mode; the wtmp file contains login data of multiple users with a wtmp structure;
[0009] Read the content of the wtmp file according to the length of the wtmp structure each time until the end of the wtmp file is reached;
[0010] Parsing the read binary format wtmp file content into various fields in the wtmp structure;
[0011] Converting each field into a readable format and storing the data in the readable format in a data table;
[0012] The data table is traversed, and the latest login time information of the target user to be found is obtained from the data table.
[0013] Optionally, traversing the data table and acquiring the latest login time information of the target user to be found from the data table includes:
[0014] In the process of traversing the data table, obtaining the user ID field of the current data;
[0015] Match the content of the user ID field with the target ID of the target user to be found;
[0016] If the match is successful, determining whether the data type of the current data is a login type;
[0017] If yes, then obtain the content of the login time field of the current data to obtain the first login time;
[0018] Compare the first login time with the latest login time of the target user currently saved;
[0019] If the first login time is later than the latest login time, the latest login time is updated to the first login time, and the data table is traversed continuously until the end of the data table is reached;
[0020] If the first login time is earlier than the latest login time, discard the current data and continue to traverse the data table until reaching the end of the data table;
[0021] The latest login time saved when reaching the end of the data table is used as the latest login time information of the target user.
[0022] Optionally, storing the data in the readable format in a data table includes:
[0023] Acquire data of a target field in the data in the readable format; the target field is a field that occupies a number of bytes less than a preset first number of bytes;
[0024] The data of the target field is stored in a data table in bit fields, and the data of other fields other than the target field are stored in the data table according to the original format of the field.
[0025] Optionally, according to the method of claim 1, it is characterized in that the step of parsing the read binary format wtmp file content into various fields in the wtmp structure comprises:
[0026] Divide the wtmp file content into multiple task segments according to the number of bytes;
[0027] Determine a first number of threads to be created according to the number of available CPU cores and the number of the task segments, and create the first number of threads;
[0028] At least one parsing task of the task segment is assigned to each process, and the process is controlled to parse the content of the wtmp file according to the length of one wtmp structure each time until the end of the task segment is reached.
[0029] Optionally, converting each field into a readable format includes:
[0030] Convert the fields in timestamp format to date format and convert the fields in byte string format to string format.
[0031] Optionally, the wtmp structure includes a record type field, a logged-in terminal device name field, a user name field, a remote login host name field, a login time field, and an IP address field of the remote host.
[0032] A second aspect of the present invention provides a user login data collection device, the device comprising:
[0033] An opening module is used to open the system's wtmp file in binary mode; the wtmp file contains login data of multiple users with a wtmp structure;
[0034] A reading module, used for reading the content of the wtmp file each time according to the length of one wtmp structure until the end of the wtmp file is reached;
[0035] A parsing module, used for parsing the read binary format wtmp file content into various fields in the wtmp structure;
[0036] A conversion module, used for converting each field into a readable format and storing the data in the readable format in a data table;
[0037] The acquisition module is used to traverse the data table and acquire the latest login time information of the target user to be found from the data table.
[0038] Optionally, the acquisition module is specifically used for:
[0039] In the process of traversing the data table, obtaining the user ID field of the current data;
[0040] Match the content of the user ID field with the target ID of the target user to be found;
[0041] If the match is successful, determining whether the data type of the current data is a login type;
[0042] If yes, then obtain the content of the login time field of the current data to obtain the first login time;
[0043] Compare the first login time with the latest login time of the target user currently saved;
[0044] If the first login time is later than the latest login time, the latest login time is updated to the first login time, and the data table is traversed continuously until the end of the data table is reached;
[0045] If the first login time is earlier than the latest login time, discard the current data and continue to traverse the data table until reaching the end of the data table;
[0046] The latest login time saved when reaching the end of the data table is used as the latest login time information of the target user.
[0047] Optionally, the conversion module is specifically used to:
[0048] Acquire data of a target field in the data in the readable format; the target field is a field that occupies a number of bytes less than a preset first number of bytes;
[0049] The data of the target field is stored in a data table in bit fields, and the data of other fields other than the target field are stored in the data table according to the original format of the field.
[0050] Optionally, the parsing module is specifically used for:
[0051] Divide the wtmp file content into multiple task segments according to the number of bytes;
[0052] Determine a first number of threads to be created according to the number of available CPU cores and the number of the task segments, and create the first number of threads;
[0053] At least one parsing task of the task segment is assigned to each process, and the process is controlled to parse the content of the wtmp file according to the length of one wtmp structure each time until the end of the task segment is reached.
[0054] Optionally, the conversion module is specifically used to:
[0055] Convert the fields in timestamp format to date format and convert the fields in byte string format to string format.
[0056] The embodiments of the present invention have the following beneficial effects:
[0057] In an embodiment of the present invention, the system's wtmp file is opened in binary mode; the wtmp file contains login data of multiple users with a wtmp structure; the content of the wtmp file is read each time according to the length of the wtmp structure until the end of the wtmp file is reached; the read binary format of the wtmp file content is parsed into each field in the wtmp structure; the fields are converted into a readable format, and the data in the readable format is stored in a data table; the data table is traversed, and the latest login time information of the target user to be found is obtained from the data table. This solution uses the log technology that comes with the Linux kernel to perform binary parsing on the wtmp file, without considering the design differences between different distributions, and is compatible with most Linux distributions, avoiding the complexity of the parsing solution caused by different system languages, and is a faster and more accurate user login data collection solution. BRIEF DESCRIPTION OF THE DRAWINGS
[0058] Figure 1 It is a flowchart of the steps of a method for collecting user login data provided by an embodiment of the present invention;
[0059] Figure 2 It is a structural block diagram of a user login data collection device provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0060] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0061] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, "multiple" means two or more. In addition, the use of "based on" or "according to" means openness and inclusiveness, because the process, steps, calculations or other actions "based on" or "according to" one or more of the conditions or values may be based on additional conditions or values beyond the described values in practice.
[0062] Figure 1 It is a step flow chart of a user login data collection method provided by an embodiment of the present invention.
[0063] like Figure 1 As shown, the method comprises the following steps:
[0064] Step 101, using binary mode to open the system's wtmp file; the wtmp file contains login data of multiple users with a wtmp structure;
[0065] The system's wtmp file is usually located in the system's / var / log / wtmp path. The wtmp file is a log file used in Linux systems to record system login and logout information. The wtmp file stores the history of all user logins and logouts. This allows system administrators to trace user activities and perform system performance analysis and auditing.
[0066] When opening a wtmp file in binary mode, the data in the file will be read as bytes without any conversion.
[0067] Step 102: Read the content of the wtmp file each time according to the length of the wtmp structure until the end of the wtmp file is reached.
[0068] In the wtmp file, the system generates a data record each time a user logs in or out. One data record corresponds to one wtmp structure length. Each data record contains the above 12 fields, and the length of each data record is equal. If a user logs in and out multiple times, the system generates multiple data records in the wtmp file, and each data record occupies one wtmp structure length.
[0069] The file content is read each time according to the length of a wtmp structure, that is, one user data is read each time, and the reading is looped until the end of the wtmp file is reached.
[0070] Step 103: Parse the read binary format wtmp file content into various fields in the wtmp structure.
[0071] The binary format wtmp file consists of multiple bytes, each byte is represented by a value between -128 and 127. Parsing the content of the wtmp file means extracting useful information from the binary file according to the structure of the wtmp file to obtain the content of each field.
[0072] In a possible implementation, the wtmp structure includes a record type field, a logged-in terminal device name field, a user name field, a remote logged-in host name field, a login time field, and a remote host IP address field.
[0073] Specifically, the wtmp file data structure is shown in Table 1 below:
[0074] Table 1
[0075] wtmp —Type: int16 -Pad0_unused:[2]byte —PID: [4] byte —Line:[LINESIZE]int8 -ID:[4]int8 -User:[NAMESIZE]int8 -Host:[HOSTSIZE]int8 -Exit:ExitStatus —Session: int32 -TV:TimeVal —AddrV6: [4] int32 -Pad1_unused:
[20] int8
[0076] The details of each field are:
[0077] 1. Type (int16): The type of record. Possible values include login record, logout record, system startup record, etc.
[0078] 2. Pad0_unused ([2]byte): padding field used for alignment, not actually used in the structure. Occupies 2 bytes.
[0079] 3.PID ([4]byte): The process ID of the login process. Usually a 4-byte number.
[0080] 4. Line ([LINESIZE] int8): The name of the terminal device, for example " / dev / ttyS0". LINESIZE is a constant that defines the size of this field, usually 32.
[0081] 5.ID ([4]int8): terminal name suffix, or inittab ID. Usually a 4-byte string.
[0082] 6. User ([NAMESIZE] int8): User name. NAMESIZE is a constant that defines the size of this field, usually 32.
[0083] 7.Host ([HOSTSIZE] int8): Host name for remote login, or kernel version (for run-level messages). HOSTSIZE is a constant that defines the size of this field, usually 256.
[0084] 8.Exit (ExitStatus): Process exit status, used when marked as DEAD_PROCESS. This field is not used in Linux init.
[0085] 9.Session (int32): Session ID, obtained using the getsid(2) system call, usually used for window management.
[0086] 10.TV (TimeVal): records the creation time. TimeVal usually contains two fields: seconds and microseconds.
[0087] 11.AddrV6([4]int32): The IP address of the remote host. For IPv4 addresses, only AddrV6[0] is used. For IPv6 addresses, the entire array is used.
[0088] 12.Pad1_unused(
[20] int8): Padding field reserved for future use, occupies 20 bytes.
[0089] In a possible implementation, step 103 includes:
[0090] Step 1021, dividing the wtmp file content into multiple task segments according to the number of bytes;
[0091] Step 1022: Determine a first number of threads to be created according to the number of available CPU cores and the number of the task segments, and create the first number of threads;
[0092] Step 1023: Allocate at least one parsing task of the task segment to each process, and control the process to parse the content of the wtmp file according to the length of one wtmp structure each time until reaching the end of the task segment.
[0093] In step 1021 to step 1023, the wtmp file may be relatively large, and the parsing speed can be effectively improved by parsing different parts in parallel in a multi-threaded and multi-process manner.
[0094] Specifically, the wtmp file is divided into a plurality of task segments according to the number of bytes or the number of lines. The number of threads or processes that can be created is determined according to the number of CPU cores that can be used or the IO performance bottleneck. If the number is the first number, the first number of threads or processes is created.
[0095] Each thread or process is independently responsible for parsing the reading task of the assigned task segment. After the parsing is completed, the parsing results of each thread or process are summarized to obtain the entire parsing result.
[0096] Step 104: Convert the various fields into a readable format, and store the data in the readable format in a data table.
[0097] After parsing, each field is still in binary format, and the binary format content is converted into an easy-to-understand readable format. The converted readable format data is stored in a data structure, which can be a data dictionary or a data table.
[0098] In a possible implementation, converting the various fields into a readable format includes:
[0099] Step 1041: Convert the field in the timestamp format to the date format, and convert the field in the byte string format to the string format.
[0100] A timestamp usually represents the number of seconds or milliseconds since a fixed point in time, such as 00:00:00 UTC on January 1, 1970. To convert a millisecond timestamp to a human-readable date format, you can use the DateTimeFormatter class and specify the desired date and time format style, such as "yyyy-MM-ddHH:mm:ss".
[0101] Bytes is a representation of binary data. It consists of a series of bytes, each of which is an integer ranging from 0 to 255. In order to read a byte string, you need to convert the byte string into a string. A string is a string of characters consisting of numbers, letters, and underscores, which is more readable than binary data.
[0102] In a possible implementation manner, storing the data in the readable format in a data table includes:
[0103] Step 1042, obtaining data of a target field in the readable format data; the target field is a field that occupies a number of bytes less than a preset first number of bytes;
[0104] Step 1043: Store the data of the target field in a data table in bit fields, and store the data of other fields other than the target field in the data table according to the original format of the field.
[0105] In step 1042-step 1043, for the wtmp structure, the memory usage can be reduced through bit fields to improve the efficiency of parsing and processing.
[0106] A bit field is a special data structure that allows us to divide the storage space of an integer type (such as int, short, etc.) into multiple smaller parts, each of which is called a bit field, and assign a name to each bit field. The width of the bit field is measured in bits and can be 1 bit, 2 bits, 3 bits, etc.
[0107] The first byte number can be set in advance, and the field smaller than the first byte number can be used as the target field, and then the data of the target field is stored in bit fields. For example, if the first byte number is set to 3, the Type field in the wtmp structure has only 2 bytes, and the Type field can be used as the target field.
[0108] If some target fields in the structure occupy fewer bytes, using existing data types to store them will result in a waste of bytes. However, by using bit fields to store the target fields, memory can be saved.
[0109] Step 105: traverse the data table, and obtain the latest login time information of the target user to be found from the data table.
[0110] After storing the data in a readable format in a data table, the latest login time of the target user can be obtained by traversing the data table.
[0111] In a possible implementation, step 105 includes:
[0112] Step 1051, in the process of traversing the data table, obtaining the user ID field of the current data;
[0113] Step 1052: Match the content of the user ID field with the target ID of the target user to be found;
[0114] Step 1053: If the match is successful, determine whether the data type of the current data is a login type;
[0115] Step 1054: If yes, obtain the content of the login time field of the current data to obtain the first login time;
[0116] Step 1055: compare the first login time with the latest login time of the target user currently saved;
[0117] Step 1056: If the first login time is later than the latest login time, update the latest login time to the first login time, and continue to traverse the data table until reaching the end of the data table;
[0118] Step 1057: If the first login time is earlier than the latest login time, discard the current data and continue to traverse the data table until the end of the data table is reached;
[0119] Step 1058: Use the latest login time saved when reaching the end of the data table as the latest login time information of the target user.
[0120] In step 1051-step 1058, the latest login time of the target user is obtained by traversing the data table. Specifically, for each data traversed, the user ID field of the current data is obtained and matched with the ID of the target user to confirm whether the current data is the data of the target user. If it is not the data of the target user, continue to traverse until the data of the target user is found.
[0121] After finding the target user's data, obtain the content of the Type field of the data to confirm whether the type of the data is a login type. If not, continue to traverse the data table to find data that is the target user ID data and whose data type is a login type. If so, you can check whether the data is the user's most recent login data. Specifically, obtain the content of the login time field of the current data to obtain the first login time; compare the first login time with the latest login time of the target user currently saved. If the first login time is later than the latest login time, update the latest login time to the first login time, and continue to traverse the data table. When a new first login time is found, compare it with the latest login time saved by the system, and then update it until the end of the data table is reached.
[0122] In this way, through traversal and comparison, what is finally saved in the system is the latest login time information of the target user.
[0123] In summary, in an embodiment of the present invention, a system wtmp file is opened in binary mode; the wtmp file contains login data of multiple users with a wtmp structure; the content of the wtmp file is read according to the length of a wtmp structure each time until the end of the wtmp file is reached; the read binary format of the wtmp file content is parsed into each field in the wtmp structure; each field is converted into a readable format, and the data in the readable format is stored in a data table; the data table is traversed, and the latest login time information of the target user to be searched is obtained from the data table. This solution uses the log technology that comes with the Linux kernel to perform binary parsing on the wtmp file, without considering the design differences between different distributions, adapting to most Linux distributions, avoiding the complexity of the parsing scheme caused by different system languages, and is a faster and more accurate user login data collection scheme. In addition, the use of bit fields to store part of the data can reduce memory usage and improve the efficiency of parsing and processing. In addition, the file content is parsed in a multi-process parallel manner, which greatly improves the speed of data parsing.
[0124] Figure 2 It is a structural block diagram of a user login data collection device provided by an embodiment of the present invention.
[0125] like Figure 2 As shown, the user login data collection device 200 includes:
[0126] The opening module 201 is used to open the system's wtmp file in binary mode; the wtmp file contains login data of multiple users with a wtmp structure;
[0127] A reading module 202, configured to read the content of the wtmp file each time according to the length of the wtmp structure until the end of the wtmp file is reached;
[0128] The parsing module 203 is used to parse the read binary format wtmp file content into various fields in the wtmp structure;
[0129] A conversion module 204, used to convert each field into a readable format, and store the data in the readable format in a data table;
[0130] The acquisition module 205 is used to traverse the data table and acquire the latest login time information of the target user to be found from the data table.
[0131] Optionally, the acquisition module 205 is specifically used for:
[0132] In the process of traversing the data table, obtaining the user ID field of the current data;
[0133] Match the content of the user ID field with the target ID of the target user to be found;
[0134] If the match is successful, determining whether the data type of the current data is a login type;
[0135] If yes, then obtain the content of the login time field of the current data to obtain the first login time;
[0136] Compare the first login time with the latest login time of the target user currently saved;
[0137] If the first login time is later than the latest login time, the latest login time is updated to the first login time, and the data table is traversed continuously until the end of the data table is reached;
[0138] If the first login time is earlier than the latest login time, discard the current data and continue to traverse the data table until reaching the end of the data table;
[0139] The latest login time saved when reaching the end of the data table is used as the latest login time information of the target user.
[0140] Optionally, the conversion module 204 is specifically configured to:
[0141] Acquire data of a target field in the data in the readable format; the target field is a field that occupies a number of bytes less than a preset first number of bytes;
[0142] The data of the target field is stored in a data table in bit fields, and the data of other fields other than the target field are stored in the data table according to the original format of the field.
[0143] Optionally, the parsing module 203 is specifically used for:
[0144] Divide the wtmp file content into multiple task segments according to the number of bytes;
[0145] Determine a first number of threads to be created according to the number of available CPU cores and the number of the task segments, and create the first number of threads;
[0146] At least one parsing task of the task segment is assigned to each process, and the process is controlled to parse the content of the wtmp file according to the length of one wtmp structure each time until the end of the task segment is reached.
[0147] Optionally, the conversion module 204 is specifically configured to:
[0148] Convert the fields in timestamp format to date format and convert the fields in byte string format to string format.
[0149] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.
[0150] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).
[0151] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that comply with the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.
[0152] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.
Claims
1. A user login data collection method, characterized in that: The method comprises: Open the system's wtmp file in binary mode; the wtmp file contains login data of multiple users with a wtmp structure; Read the content of the wtmp file according to the length of the wtmp structure each time until the end of the wtmp file is reached; Parsing the read binary format wtmp file content into various fields in the wtmp structure; Converting each field into a readable format and storing the data in the readable format in a data table; The data table is traversed, and the latest login time information of the target user to be found is obtained from the data table.
2. The method according to claim 1, characterized in that The traversing the data table and obtaining the latest login time information of the target user to be found from the data table includes: In the process of traversing the data table, obtaining the user ID field of the current data; Match the content of the user ID field with the target ID of the target user to be found; If the match is successful, determining whether the data type of the current data is a login type; If yes, then obtain the content of the login time field of the current data to obtain the first login time; Compare the first login time with the latest login time of the target user currently saved; If the first login time is later than the latest login time, the latest login time is updated to the first login time, and the data table is traversed continuously until the end of the data table is reached; If the first login time is earlier than the latest login time, discard the current data and continue to traverse the data table until reaching the end of the data table; The latest login time saved when reaching the end of the data table is used as the latest login time information of the target user.
3. The method according to claim 1, characterized in that The storing the data in the readable format in a data table comprises: Acquire data of a target field in the data in the readable format; the target field is a field that occupies a number of bytes less than a preset first number of bytes; The data of the target field is stored in a data table in bit fields, and the data of other fields other than the target field are stored in the data table according to the original format of the field.
4. The method according to claim 1, characterized in that: The step of parsing the read binary wtmp file content into various fields in the wtmp structure includes: Divide the wtmp file content into multiple task segments according to the number of bytes; Determine a first number of threads to be created according to the number of available CPU cores and the number of the task segments, and create the first number of threads; At least one parsing task of the task segment is assigned to each process, and the process is controlled to parse the content of the wtmp file according to the length of one wtmp structure each time until the end of the task segment is reached.
5. The method according to claim 1, characterized in that The converting each field into a readable format comprises: Convert the fields in timestamp format to date format and convert the fields in byte string format to string format.
6. The method according to claim 1, characterized in that The wtmp structure includes a record type field, a logged-in terminal device name field, a user name field, a remote logged-in host name field, a login time field, and an IP address field of a remote host.
7. A user login data collection device, characterized in that: The device comprises: An opening module is used to open the system's wtmp file in binary mode; the wtmp file contains login data of multiple users with a wtmp structure; A reading module, used for reading the content of the wtmp file each time according to the length of one wtmp structure until the end of the wtmp file is reached; A parsing module, used for parsing the read binary format wtmp file content into various fields in the wtmp structure; A conversion module, used for converting each field into a readable format and storing the data in the readable format in a data table; The acquisition module is used to traverse the data table and acquire the latest login time information of the target user to be found from the data table.
8. The device according to claim 7, characterized in that The acquisition module is specifically used for: In the process of traversing the data table, obtaining the user ID field of the current data; Match the content of the user ID field with the target ID of the target user to be found; If the match is successful, determining whether the data type of the current data is a login type; If yes, then obtain the content of the login time field of the current data to obtain the first login time; Compare the first login time with the latest login time of the target user currently saved; If the first login time is later than the latest login time, the latest login time is updated to the first login time, and the data table is traversed continuously until the end of the data table is reached; If the first login time is earlier than the latest login time, discard the current data and continue to traverse the data table until reaching the end of the data table; The latest login time saved when reaching the end of the data table is used as the latest login time information of the target user.
9. An electronic device, characterized in that: The electronic device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the user login data collection method as described in any one of claims 1-6.
10. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the user login data collection method as described in any one of claims 1-6.