topic Re: user log in report script .. in Operating System - HP-UX

user log in report script ..

someone_4 — Wed, 20 Feb 2002 19:00:26 GMT

Hey everyone ..
Hope everyone is having a great Hump Day ..
I have been asked to generate a user log in report. My boss wants to know who and when people have been loggging into our server so we can look for activity that is just not right. We mainly want ftp and telnet.Does anyone have any suggestion as to what extra logging I need to turn on or what logs I need to go though to get this?

Thanks
Richard

Re: user log in report script ..

Mark Greene_1 — Wed, 20 Feb 2002 19:03:47 GMT

"who" tells you who is logged in now, "last" gives you history, including ftp. The the man pages for more info.

HTH
mark

Re: user log in report script ..

Walter Bezdek — Wed, 20 Feb 2002 19:12:58 GMT

Further to the reply already received...

You can also use lastb to see bad logins.

I was asked to do something similar to what you are asking about. In my case, I needed to log the IP address that each user logging in was coming from. What I did was the following:

1. Edit the /etc/profile file, as it is run whenever someone logs on.
2. Added code to gather this data and log to a file:

who -m | read -r VAR1 VAR2 VAR3
who -a | grep $VAR2 >> /var/adm/ttmp

Hope this helps!

Tony

Re: user log in report script ..

Mark Fenton — Wed, 20 Feb 2002 20:06:23 GMT

if accounting is turned on, you can retreive a bunch of summary info from those logs:

man acctsh for details.

Re: user log in report script ..

Sandip Ghosh — Wed, 20 Feb 2002 21:11:26 GMT

Turn on the inetd logs
#inetd -l

It will give you the IP address and the Machine Name (If the IP Add is resolved through DNS, otherwise it will give unknown)from where the user had logged in. You will get the PID No. also.

Hope this will solve your Problem.

Sorry I have not mentioned the file where you will get the output. It is /var/adm/syslog/syslog.log

Sandip