topic Re: Time user was created in Operating System - HP-UX

Time user was created

Joe J_1 — Wed, 11 Oct 2006 12:43:19 GMT

Hello,

Is there anyway to tell when a user was created on an 11.11 system?

Joe

Re: Time user was created

James R. Ferguson — Wed, 11 Oct 2006 12:48:20 GMT

Hi Joe:

Only by inference. Unix does not maintain any notion of a "creation" time. The closest you get is a file or directory's last modification time --- 'mtime'.

With directories, the 'mtime' is updated as entities are added and/or removed.

Hence, the answer to your question is "no, not with assurance; only by inference".

Regards!

...JRF...

Re: Time user was created

spex — Wed, 11 Oct 2006 12:51:02 GMT

Joe,

Study the hidden files in the user's home directory. As long as a "skeleton" file hasn't been modified since user creation, you can infer the creation time.

PCS

Re: Time user was created

A. Clay Stephenson — Wed, 11 Oct 2006 12:51:20 GMT

If you know this, it is only be accident and cannot in any sense be trusted. UNIX has no notion of the creation time of a file. If (for security reasons), you need to keep up with when a user was created and/or deleted/disabled then you have to craft custom scripts and maintain that data in some sort of database -- even if that database is simply a text file.

Re: Time user was created

Victor Fridyev — Wed, 11 Oct 2006 12:53:05 GMT

Hi,

You can look for that in the /var/log/samlog file, but I'm not sure that SAM writes details of its operations. If the user has been created by useradd, any chance to know the user's creation date.
If you can guarantee that all users are created by SAM, use the option of running a script after user creation. I use this and write date of user creation into comment field.

HTH

Re: Time user was created

Joe J_1 — Wed, 11 Oct 2006 12:56:48 GMT

Thanks for the comments. That's what I thought.

Re: Time user was created

Yang Qin_1 — Wed, 11 Oct 2006 13:02:23 GMT

If you just want to check a specific user and
1. you created this user from SAM and you still have a "complete" /var/sam/log/samlog maybe you have a chance to find a record there.

2. If that user has not touched his .profile, .login .kshrc then you can find the information from time stamp of these files.

3. if you never reset your /var/adm/wtmp or you believe that file contain the information long before the user created you can run "last username" to trace when is the first time that user logged on to your server.

4. sometime a very old backup tape may help.