topic Re: HPUX 10.20: Last User Login in Operating System - HP-UX

HPUX 10.20: Last User Login

LG Porter — Thu, 12 Dec 2002 15:36:04 GMT

I have several K-Class servers that I manage running HPUX 10.20. I would to determine the last time each user logged into the system on each of these servers or the last date used. Is there another method to extract this information other that using the 'last -R' command? This information is usally contained in the wtmp. This there another log that my contain this information?

Re: HPUX 10.20: Last User Login

Chris Wilshaw — Thu, 12 Dec 2002 15:41:22 GMT

last -R is the main one, although if you clear out your wtmp file, you lose the info.

If you need a different way of doing it, change /etc/profile and /etc/csh.login so that at the end of each, it does a

touch $HOME/.lastlogin

This then creates a file called .lastlogin in each users home directory which you can then use to see when the last logged in.

Re: HPUX 10.20: Last User Login

John Palmer — Thu, 12 Dec 2002 15:41:26 GMT

Hi,

You could try the last accessed date on their .profile but it's not foolproof.

wtmp *is* the logfile that contains this information but it's good practice to tidy it regularly so you could lose information.

How about amending /etc/profile or .profile to simply write the current date/time to a file based on ${LOGNAME}.

Regards,
John

Re: HPUX 10.20: Last User Login

Paul Sperry — Thu, 12 Dec 2002 15:45:35 GMT

why not just look at the date of the users
.sh_history file?

Re: HPUX 10.20: Last User Login

John Palmer — Thu, 12 Dec 2002 15:51:10 GMT

Hi Paul,

I initially thought of that but it's going to be the time they logged out (or issued the last command if still logged in) rather than the time they logged in. It does match the requested criteria 'or the last date used' though.

Regards,
John

Re: HPUX 10.20: Last User Login

Chuck J — Thu, 12 Dec 2002 15:51:46 GMT

I would've said the same as John, check the last date used of their .profile file:

# ls -ltu /home/chuckj/.profile

For future, you could write a script that gets executed via /etc/profile that creates a file with the data you require.

Or, if you want to do it for all users at this polint in time you could write a script that something like:

cd /home
for user in *.*
do
ls -ltu /home/chuckj/.profile >> /tmp/lastlogin

etc...

Chuck J

Re: HPUX 10.20: Last User Login

Chuck J — Thu, 12 Dec 2002 15:52:18 GMT

Re: HPUX 10.20: Last User Login

Shannon Petry — Thu, 12 Dec 2002 15:59:02 GMT

All Unices have Berkely System Accounting on them or available. Solaris, AIX, and Linux have it is add on products, but Irix and HP-UX have built in accounting.

In most sites, I run accounting even if I dont really use it. It keeps the /var/atm/*tmp files clean, as well as gets me info when I need it.

man accounting

It's relatively simple to setup.
change /etc/rc.config.d/acct file START_ACCT=0 to START_ACCT=1.

Run /usr/sbin/acct/turnacct on

The man pages will tell you what to run in cron, as well as other utilities you can use to extract data from reports.

The only thing the man pages dont tell you, is that you need to periodically clean up /var/adm/acct/sum, especially if your running daily accounting.

Accounting gets you lots of info, and in my opinion is worth setting up on all systems mainly because I have information when I need it for processes that ran, who the cpu hogs are, disk hogs, last logins, etc...

Regards,
Shannon