topic Re: search inactive users in Operating System - HP-UX

search inactive users

Emir Faisal — Mon, 31 May 2004 06:34:13 GMT

Hi,
how search "who has logged in for the last 3 month" ? I've tried 'last', but it doesn't have any 'year' information.

Re: search inactive users

Manish Srivastava — Mon, 31 May 2004 06:45:20 GMT

Hi,

You can use the who(1) command to find the time the user logged into the system. It gives the date and time the use logged into the system,

man who will help.

manish.

Re: search inactive users

Jose Mosquera — Mon, 31 May 2004 07:01:58 GMT

Hi,

The "last" command output depend of the info logged into /var/adm/wtmp file. May be this file is too big or corrupted. To fix:
# cp /dev/null /var/adm/wtmp

Other way to check last logig date will be checking the timestamp of .sh_history into $HOME directory of each user. Off course, for this, users must be active history log.

Rgds.

Re: search inactive users

Emir Faisal — Mon, 31 May 2004 07:21:20 GMT

I've read the man page, but I can't make it display any year information. It only print 31 May without year.
Maybe I miss something from the man page ? I use "who -a".

Re: search inactive users

Emir Faisal — Mon, 31 May 2004 07:29:31 GMT

is "cp /dev/null /var/adm/wtmp" will zero my login record ? This is not what i want.

command line history mostly turned off on our system.

Re: search inactive users

Jose Mosquera — Mon, 31 May 2004 07:41:43 GMT

Hi again,

If the year is not indicated, asummes that is the current year.

Previously you had not been especific for your issue, for that reason I thought that the problem was of corruption of the file and I suggested you to copy /dev/null. So pls do not copy null in your case.

Try to be full explicit in your issue description.

Rgds.

Re: search inactive users

Emir Faisal — Mon, 31 May 2004 07:52:59 GMT

Hi,
I'm sorry for not being clear enough describing my problems. I want to know who has (and hasn't) logged in to the machine for the last 3 month. This machine alive from 2001 with /var/adm/wtmp around 34906800 bytes.

My temporary solution is:

$ cat /var/adm/wtmp | /usr/sbin/acct/fwtmp

and parse the result with some perl script.

I'm looking for nicer solutions :D.

rgrds,
EF

Re: search inactive users

Jose Mosquera — Mon, 31 May 2004 08:03:00 GMT

Hi,

Ok, don't worry about. I suggest you taht keep your /var/adm/wtmp file into a sane size. Your size is out of recomended ranges and in any moment could being corrupted.
SAM/System Log Files/ Menu provide you options to keep a sane size of some important log files of your system.

A trick to keep a trial of last user access if put in your /etc/prifile file the following sentence:
touch $HOME/.last_login

With this the .last_login file placed into the each $HOME user directory will be updated with last login timestamp.

Rgds

Re: search inactive users

Geoff Wild — Mon, 31 May 2004 13:10:03 GMT

Try this:

for i in `cat /etc/passwd |awk -F: '{print $1}'`
do
finger $i
done

Rgds...Geoff

Re: search inactive users

Bill Hassell — Mon, 31 May 2004 14:42:10 GMT

VERY IMPORTANT: wtmp has *NO* year information logged. You must truncate the file every few months. If not, last will report ghost logins and logins without logouts. This is a limitation of the wtmp file format and cannot be changed.

Re: search inactive users

Emir Faisal — Mon, 31 May 2004 20:09:02 GMT

Mr. Bill Hassel:
wtmp did have year information in it. you can try by invoking:

cat /var/adm/wtmp | /usr/sbin/acct/fwtmp

But I don't know how to display it.

---
Mr. Jose Maria Mosquera:
I can't trim my wtmp, because there no recommended size for wtmp entry.

/var/adm/wtmp NA 34958520 NA

should I manually trim it to a sane size ?

rgds,
EF

Re: search inactive users

Bill Hassell — Mon, 31 May 2004 22:10:14 GMT

You are correct. The wtmp format is described in the wtmp man page. The date is stored in wtmp in binary. It is last (and lastb) that do not display the year.

The wtmp (and utmp and btmp) file is binary so it cannot be trimmed, at least in a simple manner. Your example:

cat /var/adm/wtmp | /usr/sbin/acct/fwtmp

is the method to convert from the binary format into ASCII. The resultant ASCII file can then be manually edited. NOTE: There may be logins that span the date you choose so a simple truncation of the ASCII file may create ghost sessions in last. There isn't an easily scriptable method to truncate wtmp or btmp. The best choice is to copy wtmp into an archive directory, then zero the current wtmp file (at reboot).

To accomplish the task to see who has not logged in for during the last 3 months, use fwtmp to format wtmp and search the the ASCII formatted output. wtmp and btmp grow without bounds so they can be very large, a good reason to zero this file every 3-6 months.

Re: search inactive users

Joseph Loo — Mon, 31 May 2004 23:57:54 GMT

hi,

use this:

# /usr/bin/last -R > /tmp/whologin
to create a file "whologin" of users who successfully login
# /usr/bin/lastb -R > /tmp/badlogin
to create a file "badlogin" of users who failed to login

the file created are in descending order (earliest date first)

as u have realise, there is no year to it, but u could
# /usr/bin/last -R -1000 > /tmp/last1000line_whologin
to create a file "last1000line_whologin" of the last 1000 successful login

hope the above helps.

regards.

Re: search inactive users

Mohanasundaram_1 — Tue, 01 Jun 2004 06:31:10 GMT

Hi EMir,

try this script, I checked this script and it gives me the year if it is not the current year.

#!/usr/bin/ksh
# Script to find out dormant users

while read LINE;do

# extract usernames and home directories from /etc/passwd

USER=$(echo $LINE|awk -F: '{print $1}')
HOMEDIR=$(echo $LINE|awk -F: '{print $6}')

# extract login info from finger using grep

LAST_LOGIN=$(finger ${USER}|grep -E 'Last login|Never logged')

echo "$USER\t$HOMEDIR\t$LAST_LOGIN"
done < /etc/passwd
exit

Cheers,
Mohan.