Ok, here's a working version. I chose to evaluate $LOGNAME when the trap is set, to forestall any later forgery, but you can change this if you wish, once you figure out the general principle by studying this example: echo "IN:\t$LOGNAME\t`tty`\t`date`" >> /usr/.logins trap "echo \"OUT:\t$LOGNAME\t\`tty\`\t\`date\`\" >> /usr/.logins" 0 1 15