From de61c6c77147658134c4e7dbaa8ffb9b531f2a0c Mon Sep 17 00:00:00 2001
From: PTah <papatramp@gmail.com>
Date: Tue, 23 Jun 2026 14:41:52 +1000
Subject: [PATCH] fix: daily report active users count matches who sessions
 (2.1.5-SAC)

Include local/console who lines; active_count from session list not raw who line count.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 ssh-monitor | 6 +++---
 version.txt | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/ssh-monitor b/ssh-monitor
index 4e48e6d..590e717 100644
--- a/ssh-monitor
+++ b/ssh-monitor
@@ -7,7 +7,7 @@ IFS=$'\n\t'
 # ============================================
 
 CONFIG_FILE="/etc/ssh-monitor.conf"
-SSH_MONITOR_VERSION="2.1.4-SAC"
+SSH_MONITOR_VERSION="2.1.5-SAC"
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 if [ -f "$SCRIPT_DIR/sac-client.sh" ]; then
@@ -1234,7 +1234,6 @@ get_active_ssh_sessions() {
  local line user tty login_time ip
  while IFS= read -r line; do
  [[ -z "$line" ]] && continue
- [[ "$line" != *"("* ]] && continue
  user=$(awk '{print $1}' <<<"$line")
  tty=$(awk '{print $2}' <<<"$line")
  login_time=$(awk '{print $3, $4}' <<<"$line")
@@ -1766,7 +1765,8 @@ send_daily_report() {
  local active_sessions
  active_sessions=$(get_active_ssh_sessions)
  local active_count
- active_count=$(who 2>/dev/null | grep -c "." || echo "0")
+ active_count=$(printf '%s' "$active_sessions" | grep -c '👤' || true)
+ active_count=${active_count:-0}
 
  local active_bans=0
  local ban_line
diff --git a/version.txt b/version.txt
index bd1caf3..f14000d 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-2.1.4-SAC
+2.1.5-SAC