output-eventlog-security-today-4800-4801.bat

@ECHO OFF

REM 今日の日付
SET today=%DATE:~-10,4%%DATE:~-5,2%%DATE:~-2%

REM イベントログコード4800=ログオフ, 4801=ログオンのイベントログを取得
WMIC NTEVENT WHERE "(logfile='security' AND (eventcode='4800' or eventcode='4801') and timegenerated >= '%today%')" GET EventCode,TimeGenerated /FORMAT:CSV > C:\logoff.log\%today%.log

exit

show-logoff-time.sh

#!/bin/sh

while getopts vVs OPT
do
		case $OPT in
		"v" ) VERBOSE="TRUE"
		shift
		;;
		"V" ) VERBOSE_VERBOSE="TRUE"
		shift
		;;
		"s" ) CALC_SECONDS="TRUE"
		shift
		;;
		esac
done

TODAY_INT=`date +%Y%m%d`
LOG_FILE_NAME="/cygdrive/c/logoff.log/$TODAY_INT.log"

fmt_yyyyMMddHHmmss ()
{
		awk '{
				Y = substr($0, 1,4);
				M = substr($0, 5,2);
				D = substr($0, 7,2);
				h = substr($0, 9,2);
				m = substr($0,11,2);
				s = substr($0,13,2);
				printf("%s-%s-%s %s:%s:%s UTC",Y,M,D,h,m,s);
		}';
}

if [ "$VERBOSE" = "TRUE" ] ; then
		cat $LOG_FILE_NAME| nkf 
elif [ "$VERBOSE_VERBOSE" = "TRUE" ] ; then
		cat $LOG_FILE_NAME| nkf | sed '1,2d'| while read line
		do
				DATE_UTC=`echo $line | cut -d, -f3 | cut -d. -f1 | fmt_yyyyMMddHHmmss`
				DATE_JDT=`date -d "$DATE_UTC" +'%Y-%m-%d %H:%M:%S'`
				CSV_LINE=`echo $line | cut -d, -f2 | sed -e 's/4800/4800,LOGOFF/g' -e 's/4801/4801,LOGON /g'`
				echo -n $CSV_LINE,
				echo -n $DATE_JDT
				echo 
		done
else
		LOGOFF_TIME=`cat $LOG_FILE_NAME | nkf | head -n 4 | grep 4800 | cut -d, -f3 | cut -d. -f1`
		LOGON_TIME=`cat $LOG_FILE_NAME | nkf | head -n 4 | grep 4801 | cut -d, -f3 | cut -d. -f1`

		LOGOFF_TIME_UTC_STR=`echo $LOGOFF_TIME | fmt_yyyyMMddHHmmss`
		LOGON_TIME_UTC_STR=`echo  $LOGON_TIME | fmt_yyyyMMddHHmmss`

		LOGOFF_TIME_JST=`date -d "$LOGOFF_TIME_UTC_STR" +%s`
		LOGON_TIME_JST=`date -d "$LOGON_TIME_UTC_STR" +%s`

		SECONDS_EXP="scale=3;($LOGON_TIME_JST-$LOGOFF_TIME_JST)" 

		if [ "$CALC_SECONDS" = "TRUE" ] ; then
				echo $SECONDS_EXP | bc
		else
				echo "$SECONDS_EXP/60" | bc
		fi
fi