topic Re: Tracking user login in Operating System - HP-UX

Tracking user login

bhoang — Fri, 16 Feb 2001 22:23:11 GMT

Is there a command that I can use to check if a user has login at a certain date?

Re: Tracking user login

James R. Ferguson — Fri, 16 Feb 2001 22:32:35 GMT

Hi:

Yes, use 'last' (see 'man last'). If /var/adm/wtmp is present, then this file will contain a record of all logins. Do this:

# last

If /var/adm/wtmp isn't present, then you will need to first touch it to start collecting this information. Permissions should be 644 owned by root. Trim (or create) the file by redirecting /dev/null into it:

# /dev/null > /var/adm/wtmp

Bad login attempts are (corresponding) kept in /var/adm/btmp and are interrogated with 'lastb' [see same man as above].

...JRF...

Re: Tracking user login

Jitendra_1 — Fri, 16 Feb 2001 22:32:54 GMT

"last" will show you all the details of users logged in and logged out.

Re: Tracking user login

bhoang — Fri, 16 Feb 2001 22:39:02 GMT

Hi all,
I did use the Last command but it only shows me
the last two days. What command can I use to see if the user has login on, say the first of
the month.
TIA

Re: Tracking user login

James R. Ferguson — Fri, 16 Feb 2001 22:48:08 GMT

Hi:

The file grows without bounds and is usually trimmed (dev/null > /var/adm/wtmp). In this case, the data you seek is gone.

...JRF...

Re: Tracking user login

Josee Bourget-Thuma — Sat, 17 Feb 2001 01:16:54 GMT

Hi Bach,

You will also find records of ftp login as well as records of those who "su" and which account they "su" to in /var/adm/syslog/syslog.log.

Take care,
Josee

Re: Tracking user login

Philip Chan_1 — Mon, 19 Feb 2001 01:58:06 GMT

Hi Bach,

Besides the "last" command there is another option you could try,

1. Via SAM convert your system to "trusted" mode
2. Go into SAM -> auditing and security -> audited event
3. Make sure auditing is turned on, and the login event type should include both "success" and "failure" events

After all you can view the good and bad login attempts via the "view audit log" option.

Don't know why on your system the "last" command losted its historical data. It is the simplest way to achieve what you want so use this one if possible.

Rgds,
Philip

Re: Tracking user login

Shannon Petry — Mon, 19 Feb 2001 14:28:56 GMT

One of the best tools, and least used tools is the berkely accounting package.

Read up on the man pages for runacct, pacct, and their references.

I use accounting on ALL seats. I get a monthly report on all users, each time they have logged in, for how long, what applications they ran, etc...

It's built in and free, as well as supported by HP-UX, SunOS, AIX, Irix, SCO/Unix and Linux. It gives you tons of information, most of which you wont need, but some that you do need is priceless!

Regards,
Shannon

Re: Tracking user login

Don Bentz — Tue, 20 Feb 2001 14:16:12 GMT

If the information prior to the last 2 days is important, you could restore /var/adm/wtmp to another file and use the '-f' option to the 'last' command to specify the 'old' data's collection file. BE SURE YOU DON'T restore over the top of you active file (/var/adm/wtmp).