topic Re: Rexec Logging in Operating System - HP-UX

Rexec Logging

Mark Killen — Tue, 14 May 2002 16:39:20 GMT

Hello Admin's, I am looking for a way to log who is using
rexec to access a server. In the /var/adm/syslog/syslog.log it only tells you that someone logs in using rexec. I am looking for more information like a user id and or ipaddress that it is coming from. I did some scans of the forum and did not find the info but I am sorry if it has been answered before.

Re: Rexec Logging

Tom Danzig — Tue, 14 May 2002 16:45:57 GMT

It is logged in wtmp. Try:

last -R -5 | grep rexec

to get logins of a particular user accessing via rexec.

Re: Rexec Logging

Tom Danzig — Tue, 14 May 2002 16:48:09 GMT

Sorry ... correct command is:

last -R | grep rexec

The -5 would limit the list to the last 5 logins. The above will give all since wtmp was last trimmed.

Re: Rexec Logging

steven Burgess_2 — Tue, 14 May 2002 16:48:34 GMT

Hi

Have a look at /var/adm/wtmp,using the last command

This will show who and where from

incorrect logins are looked at using lastb command

for further info

man last

Regards

Steve

Re: Rexec Logging

Bill Hassell — Tue, 14 May 2002 16:50:01 GMT

The wtmp (and btmp for failures) logs rexec:

last -5 -R root

(or whatever user you are searching for.

Use lastb to read failed rexec attempts.

Re: Rexec Logging

Mark Killen — Tue, 14 May 2002 17:00:38 GMT

I forgot to mention that I am running 10.20, the commands that you have given me work on 11.0 but not on 10.20.
The last -R command does not seem to give the rexecd in the tty area. Any other suggestions?
Thanks

Re: Rexec Logging

Helen French — Tue, 14 May 2002 17:12:58 GMT

Hi Mark:

The 'last' command will work on 10.20 too. Try this:

# last -R | grep rexec

HTH,
Shiju