topic Re: System Log files in Operating System - HP-UX

System Log files

Yajuvendra Singh — Tue, 18 Jul 2006 06:13:14 GMT

Dear All,

I want to find out the complete list of system login details either it is from console or from remote.

Please let me know how to find out.

Thanks in advance.

Re: System Log files

spex — Tue, 18 Jul 2006 06:15:17 GMT

Hi,

# last | more

PCS

Re: System Log files

Steven E. Protter — Tue, 18 Jul 2006 06:22:56 GMT

Shalom,

lastbjavascript&colon;postAnswerSubmit('submit');
Submit shows bad logins.

the files they come from:

/var/adm/syslog/wtmp (last)
/var/adm/syslog/btmp (lastb)

The -R parameter on either command will show the source of the login by IP address.

SEP

Re: System Log files

James R. Ferguson — Tue, 18 Jul 2006 06:40:20 GMT

Hi:

In addition to the 'wtmp' and 'btmp' files which can be examined with 'last' and 'lastb' respectively, you should also examine the switch-user ('su') log:

# /var/adm/sulog

You will see entries that look like:

SU 07/17 11:00 - ttyp3 jrf-root
SU 07/17 11:01 + ttyp3 jrf-root

...a "-" indicates failure; a "+" signals success. The direction of the switch is shown as the last field.

Regards!

...JRF...

Re: System Log files

spex — Tue, 18 Jul 2006 06:41:27 GMT

In the output from 'last', the first column is username, the second is the tty, the third contains login and logout timestamps, and the fourth is the session duration. If you enable the '-R' switch, the hostname of the incoming session is displayed in the third column.

On my systems (not sure if this is the same everywhere), a tty name of the form 'pts/0', 'pts/1', etc. indicates that the user logged in via ssh, while 'pts/ta', 'pts/tb', etc. indicates telnet. Examples of other tty names include 'console', 'remshd', and 'ftp'.

If you want to filter the output of 'last', you can specify a username or tty after the command. For example, 'last root' will show you logins for root, and 'last pts/0' will show logins on '/dev/pts/0'. 'lastb' behaves the same as 'last', except it displays invalid login attempts.

PCS

Re: System Log files

Peter Godron — Tue, 18 Jul 2006 06:51:07 GMT

If you just want to see who is currently logged on:
who -u

Re: System Log files

Yajuvendra Singh — Tue, 18 Jul 2006 07:44:57 GMT

Hi All,

Thanks for sharing so much valuable information.