The zsh/watch module can be used to report when specific users log in or
out. This is controlled via the following parameters.
LOGCHECKThe interval in seconds between checks for login/logout activity
using the watch parameter.
watch <S> <Z> (WATCH <S>)An array (colon-separated list) of login/logout events to report.
If it contains the single word ‘all’, then all login/logout events
are reported. If it contains the single word ‘notme’, then all
events are reported as with ‘all’ except $USERNAME.
An entry in this list may consist of a username,
an ‘@’ followed by a remote hostname,
and a ‘%’ followed by a line (tty). Any of these may
be a pattern (be sure to quote this during the assignment to
watch so that it does not immediately perform file generation);
the setting of the EXTENDED_GLOB option is respected.
Any or all of these components may be present in an entry;
if a login/logout event matches all of them,
it is reported.
For example, with the EXTENDED_GLOB option set, the following:
watch=('^(pws|barts)')
causes reports for activity associated with any user other than pws
or barts.
WATCHFMTThe format of login/logout reports if the watch parameter is set.
Default is ‘%n has %a %l from %m’.
Recognizes the following escape sequences:
%nThe name of the user that logged in/out.
%aThe observed action, i.e. "logged on" or "logged off".
%lThe line (tty) the user is logged in on.
%MThe full hostname of the remote host.
%mThe hostname up to the first ‘.’. If only the
IP address is available or the utmp field contains
the name of an X-windows display, the whole name is printed.
NOTE:
The ‘%m’ and ‘%M’ escapes will work only if there is a host name
field in the utmp on your machine. Otherwise they are
treated as ordinary strings.
%F{color} (%f)Start (stop) using a different foreground color.
%K{color} (%k)Start (stop) using a different background color.
%S (%s)Start (stop) standout mode.
%U (%u)Start (stop) underline mode.
%B (%b)Start (stop) boldface mode.
%t%@The time, in 12-hour, am/pm format.
%TThe time, in 24-hour format.
%wThe date in ‘day-dd’ format.
%WThe date in ‘mm/dd/yy’ format.
%DThe date in ‘yy-mm-dd’ format.
%D{string}The date formatted as string using the strftime function, with
zsh extensions as described by
Prompt Expansion.
%(x:true-text:false-text)Specifies a ternary expression. The character following the x is arbitrary; the same character is used to separate the text for the "true" result from that for the "false" result. Both the separator and the right parenthesis may be escaped with a backslash. Ternary expressions may be nested.
The test character x may be any one of ‘l’, ‘n’, ‘m’
or ‘M’, which indicate a ‘true’ result if the corresponding
escape sequence would return a non-empty value; or it may be ‘a’,
which indicates a ‘true’ result if the watched user has logged in,
or ‘false’ if he has logged out.
Other characters evaluate to neither true nor false; the entire
expression is omitted in this case.
If the result is ‘true’, then the true-text is formatted according to the rules above and printed, and the false-text is skipped. If ‘false’, the true-text is skipped and the false-text is formatted and printed. Either or both of the branches may be empty, but both separators must be present in any case.
Furthermore, the zsh/watch module makes available one builtin
command: