topic Re: viewing all the users loggedin in last 6 months in Operating System - HP-UX

viewing all the users loggedin in last 6 months

senthil_kumar_1 — Wed, 06 May 2009 16:57:31 GMT

Hi

I am using HP-UX 10.20, 11.00, 11.11.

I want to create a rport of all logged in users for last 3 months.

I am able to get this month report only using "last".

How to do this.

Re: viewing all the users loggedin in last 6 months

TTr — Wed, 06 May 2009 17:23:21 GMT

Not clear what exactly you need but the last command does not have any data options so you have to sent the output of the last command to a file and then edit that file and delete all the lines that are older than 3 months. Then it depends what exactly you need, for a simple list of usernames you can cut the first coulmn of the file that contains the usernames and do a unique sort.
1. last > users.txt
2. edit users.txt and delete all lines older than 3 months
3. awk '{print $1}' users.txt | sort -u

If you have may servers, you can combine the users.txt files from each server and run the 3rd command on the cumulative file.

If you need more information as the number of logins and which server it is a lot more involved.

Re: viewing all the users loggedin in last 6 months

Bijeesh — Wed, 06 May 2009 17:26:40 GMT

hi
The last command searches backwards through the file /var/adm/wtmp.Sometimes this file may be trimmed since its size will increase on every login.Check in your crontab file, is there any command is doing the same.

Re: viewing all the users loggedin in last 6 months

Steven E. Protter — Wed, 06 May 2009 17:27:26 GMT

Shalom,

The /var/adm/wtmp file contains the information.

It tends to get quite big and most sysadmins trim it to reduce its size.

But if its there the last command will parse it.

The wtmp file is the data repo and last is the way to access it.

SEP

Re: viewing all the users loggedin in last 6 months

Mel Burslan — Wed, 06 May 2009 17:37:56 GMT

output of the last command is sorted chronologically in reverse order, i.e., newest login is located on top. So if you run

last > /tmp/login_report

then

vi /tmp/login_report

you can scroll down to a place where you will see the date and time of 3 months ago (you need to manually figure this out) and delete the lines from this point to the end, you will end up with last 3 months' worth of login report.

Hope this helps.

If you want to do this with a script, please look for Clay Stephenson's caljd script (available in POSIX and perl script forms on the web, just google) and you have to experiment with the last utility combined with Clay's script for date calculation and sed command to come up with the report in the way you exactly want.

Re: viewing all the users loggedin in last 6 months

Michael Mike Reaser — Wed, 06 May 2009 18:10:23 GMT

If your sys admins have already trimmed the wtmp files on your systems so they only contains the last month's worth of data, then your sys admins have prevented you from completing this task.

Re: viewing all the users loggedin in last 6 months

senthil_kumar_1 — Thu, 07 May 2009 12:52:30 GMT

Yes i am able to see only the details from May 1 2009 using last command.

But i am not able to see before May like April, March, Feb.

At this situation, how we can get the details of user logged in for last 3 months.

Re: viewing all the users loggedin in last 6 months

Jestin John Chacko — Thu, 07 May 2009 13:00:10 GMT

Dear,
if you are provided with a putty tool to login into the server post a session with saved output

and run the command last -R -

eg last -R -20 root

will give last 20 login attempts with the ip used
may this help you...

normally sys admin will trim the wtmp file as to create the excessive filling of /var file system according to the need.

Re: viewing all the users loggedin in last 6 months

Michael Mike Reaser — Thu, 07 May 2009 13:00:32 GMT

senthil> At this situation, how we can get the details of user logged in for last 3 months.

You can't. Your system administrators have erased from your systems the data you require to complete this task.

If you need to retrieve this information for a 3-month period, your sys admins need to leave 3 months' worth of data in your wtmp files. They have not done so, and thus you cannot get this data.

It's gone. Your system administrators made it go away.

Re: viewing all the users loggedin in last 6 months

Ganesan R — Thu, 07 May 2009 13:20:34 GMT

Hi Senthilkumar,

/var/adm/wtmp is only file which keeps informations about user login and logouts. If this file is wiped out or trimmed due to some reason, then you will not ba able to get the details.

If you have any other tools like powerbroker then you may get the desired data.

Re: viewing all the users loggedin in last 6 months

UVK — Thu, 07 May 2009 15:45:52 GMT

/var/adm/wtmp is the file you need to look for login and logout report. The date till which you can extract data depends on the when the maintanence was done on your wtmp file.