Rexec Logging

[Mark Killen]

Hello Admin's, I am looking for a way to log who is using
rexec to access a server. In the /var/adm/syslog/syslog.log it only tells you that someone logs in using rexec. I am looking for more information like a user id and or ipaddress that it is coming from. I did some scans of the forum and did not find the info but I am sorry if it has been answered before.

[Tom Danzig]

It is logged in wtmp. Try:

last -R -5 | grep rexec

to get logins of a particular user accessing via rexec.

[Tom Danzig]

Sorry ... correct command is:

last -R | grep rexec

The -5 would limit the list to the last 5 logins. The above will give all since wtmp was last trimmed.

[steven Burgess_2]

Hi

Have a look at /var/adm/wtmp,using the last command

This will show who and where from

incorrect logins are looked at using lastb command

for further info

man last

Regards

Steve

[Bill Hassell]

The wtmp (and btmp for failures) logs rexec:

last -5 -R root

(or whatever user you are searching for.

Use lastb to read failed rexec attempts.

[Mark Killen]

I forgot to mention that I am running 10.20, the commands that you have given me work on 11.0 but not on 10.20.
The last -R command does not seem to give the rexecd in the tty area. Any other suggestions?
Thanks

[Helen French]

Hi Mark:

The 'last' command will work on 10.20 too. Try this:

# last -R | grep rexec

HTH,
Shiju