Watching for Other Users

zsh provides a useful means for watching and reporting logins or logouts for a certain user, from a certain host, and/or on a certain line. (tty, pty, etc.)

First, we look at what an event is, and examples of event entries. Then, we learn how to feed those events to zsh, and how to get useful reports from zsh. On the next page, we learn how to customize the appearance of these reports.

Events

For the purposes of this section, an event will refer to any login or logout on the host where zsh is running.

An event consists of the following:

The user who logged in/out
The host where the user was connected from
The line (tty) that the user was connected on

To look for events associated with a particular user, simply use their username in the event specification.
To look for events from a specific host, use '@' followed immediately by the remote hostname.
To look for events on a specific line, use '%' followed immediately by the line name. (IE, pts/186)

Any or all of these components can be present when specifying events. Zsh then reports any event that matches ALL components of the entry.

Examples of Event Entries

An entry that matches all events associated with user schrof:

schrof

An entry that matches all events from hostname nebcorp.com and on line pts/19:

@nebcorp.com%pts/19

An entry that matches all events of user root on console:

root%console

Telling zsh to look for events

You need to put the list of events that zsh should watch for in the watch or WATCH shell variable. This can be done from the command line, but you'll probably want to Normally, setting one changes the other. If the shell is invoked in sh or ksh emulation mode, however, you'll have to use the (uppercase) WATCH parameter.

Normally, you'll assign an array value to the watch parameter. There are, however, two special cases which we discuss first.

1. To monitor every event on the system, you can assign the single value of all to the watch parameter:

watch=all

2. To monitor all events except your own (tied to $USERNAME), assign the single value notme:

watch=notme

Otherwise, you'll need to assign a list of events:

watch=(event1 event2 ... eventN)

Zsh then reports all events that fully match any of the entries you placed in the watch parameter.

(See the top of this page for info on specifying event entries)

Obtaining the Report

Setting LOGCHECK to some interger n will cause zsh to report monitored events every n seconds. (60 seconds is the default.) You can have zsh report all users currently logged in who are affected by the watch parameter by running the log command at any time.

The next page contains detailed information on configuring how the reports look.