def Parse(self, stat, file_object, knowledge_base):
    """Parse the wtmp file."""
    _, _ = stat, knowledge_base
    users = {}
    wtmp = file_object.read()
    while wtmp:
      try:
        record = UtmpStruct(wtmp)
      except utils.ParsingError:
        break

      wtmp = wtmp[record.size:]
      # Users only appear for USER_PROCESS events, others are system.
      if record.ut_type != 7:
        continue

      # Lose the null termination
      record.user = record.user.split(b"\x00", 1)[0]

      # Store the latest login time.
      # TODO(user): remove the 0 here once RDFDatetime can support times
      # pre-epoch properly.
      try:
        users[record.user] = max(users[record.user], record.sec, 0)
      except KeyError:
        users[record.user] = record.sec

    for user, last_login in iteritems(users):
      yield rdf_client.User(
          username=utils.SmartUnicode(user), last_logon=last_login * 1000000)
def Parse ( self , stat , file_object , knowledge_base ) : _ , _ = stat , knowledge_base users = { } wtmp = file_object . read ( ) while wtmp : try : record = UtmpStruct ( wtmp ) except utils . ParsingError : break wtmp = wtmp [ record . size : ] if record . ut_type != 7 : continue record . user = record . user . split ( b"\x00" , 1 ) [ 0 ] try : users [ record . user ] = max ( users [ record . user ] , record . sec , 0 ) except KeyError : users [ record . user ] = record . sec for user , last_login in iteritems ( users ) : yield rdf_client . User ( username = utils . SmartUnicode ( user ) , last_logon = last_login * 1000000 )
Parse the wtmp file.