topic Re: log file in Operating System - HP-UX

log file

Jade Bulante — Tue, 12 Mar 2002 22:13:41 GMT

I would like to find out where the log file is for login failures and attempts. We're running 11.00.

Re: log file

Mark Greene_1 — Tue, 12 Mar 2002 22:15:28 GMT

they are here:

/etc/utmp
/var/adm/wtmp
/var/adm/btmp

see the man page for "last" for more info

HTH
mark

Re: log file

Christopher McCray_1 — Tue, 12 Mar 2002 22:18:01 GMT

Hello,

Two places I can think of:

/var/adm/auth.log
/var/adm/sulog

Hope this helps

Chris

Re: log file

Jade Bulante — Tue, 12 Mar 2002 22:20:38 GMT

How can you read a wtmp or btmp file since it's considered an awk text.

Re: log file

Mark Greene_1 — Tue, 12 Mar 2002 22:23:26 GMT

use last or ftwmp, but be careful as fwtmp has write capability.

mark

Re: log file

someone_4 — Tue, 12 Mar 2002 22:24:19 GMT

You use 'last' and 'lastb' to read the files. See the man pages for 'last'.

cat /var/adm/wtmp | /usr/sbin/acct/fwtmp > /var/tmp/w>

or

last -10
gives you the lasat 10 entries

last -R -10

displays the hostname

same thing with lastb.

Richard

Re: log file

someone_4 — Tue, 12 Mar 2002 22:30:24 GMT

/usr/sbin/acct/fwtmp < wtmp | more (view entire wtmp in ascii)

/usr/sbin/acct/fwtmp < wtmp | grep -eftp -eremshd | more (see if wtmp has
ftp or remsh contained in it)

/usr/sbin/acct/fwtmp < wtmp | grep -v -eftp -eremshd > wtmp.asc
(copy everything except ftp and remsh to an ascii file)

/usr/sbin/acct/fwtmp -ic < wtmp.asc > wtmp.bin
(convert ascii file to binary file)

last -f wtmp.bin
(use the 'last' command to view the binary contents of wtmp.bin)

cat /var/adm/wtmp | /usr/sbin/acct/fwtmp
fwtmp < /etc/wtmp > /tmp/filename

Re: log file

Michael Tully — Tue, 12 Mar 2002 22:32:24 GMT

You can also use grep as a filter to
analyse the output from either the
last or lastb commands.

e.g.
# last | grep fred (username)

Re: log file

Christopher McCray_1 — Tue, 12 Mar 2002 22:32:30 GMT

to read a wtmp file, use the fwtmp command

Good luck
Chris

Re: log file

Darrell Allen — Tue, 12 Mar 2002 23:46:18 GMT

Hi,

One of my favorites is to use the who command against /var/adm/wtmp. See man who for more info but I like "who -a /var/adm/wtmp".

Darrell

Re: log file

Sanjay_6 — Tue, 12 Mar 2002 23:53:37 GMT

Hi,

The first link gives a sample on how to read the info from the log files and the second link suggests what you can do to cleanup those log files,

http://us-support3.external.hp.com/cki/bin/doc.pl/sid=fe90b163102fbbb47b/screen=ckiDisplayDocument?docId=200000054497817

http://us-support3.external.hp.com/cki/bin/doc.pl/sid=fe90b163102fbbb47b/screen=ckiDisplayDocument?docId=200000058669444

Hope this helps.

Regds

Re: log file

pap — Wed, 13 Mar 2002 00:24:07 GMT

Hi Here are those files.

/etc/utmp
/var/adm/wtmp
/var/adm/btmp

Here is the explanation about those files.

A. File utmp contains a record of all users logged onto the system.

B. File btmp contains bad login entries for each invalid logon attempt.

C. File wtmp contains a record of all logins and logouts.

Re: log file

Van Weyenberg Els — Thu, 25 Apr 2002 07:00:23 GMT

Sanjay, I can't access the link you suggested above about cleanup /var/adm/wtmp. Also a search on document ID doesn't work. Maybe that's because I'm connecting from Europe. Is there another way to access this information ? Thank you.