cancel
Showing results for 
Search instead for 
Did you mean: 

Rexec Logging

Mark Killen
Occasional Advisor

Rexec Logging

Hello Admin's, I am looking for a way to log who is using
rexec to access a server. In the /var/adm/syslog/syslog.log it only tells you that someone logs in using rexec. I am looking for more information like a user id and or ipaddress that it is coming from. I did some scans of the forum and did not find the info but I am sorry if it has been answered before.
life is too short to work so long
6 REPLIES
Tom Danzig
Honored Contributor

Re: Rexec Logging

It is logged in wtmp. Try:

last -R -5 | grep rexec

to get logins of a particular user accessing via rexec.
Tom Danzig
Honored Contributor

Re: Rexec Logging

Sorry ... correct command is:

last -R | grep rexec

The -5 would limit the list to the last 5 logins. The above will give all since wtmp was last trimmed.
steven Burgess_2
Honored Contributor

Re: Rexec Logging

Hi

Have a look at /var/adm/wtmp,using the last command

This will show who and where from

incorrect logins are looked at using lastb command

for further info

man last

Regards

Steve
take your time and think things through
Bill Hassell
Honored Contributor

Re: Rexec Logging

The wtmp (and btmp for failures) logs rexec:

last -5 -R root

(or whatever user you are searching for.

Use lastb to read failed rexec attempts.


Bill Hassell, sysadmin
Mark Killen
Occasional Advisor

Re: Rexec Logging

I forgot to mention that I am running 10.20, the commands that you have given me work on 11.0 but not on 10.20.
The last -R command does not seem to give the rexecd in the tty area. Any other suggestions?
Thanks
life is too short to work so long
Helen French
Honored Contributor

Re: Rexec Logging

Hi Mark:

The 'last' command will work on 10.20 too. Try this:

# last -R | grep rexec

HTH,
Shiju
Life is a promise, fulfill it!