executing scripts upon user logout

[DeafFrog]

Hi Gurus ,

             My requirement is to find the list of modified files , between the time a user login and log out.

             If login time and log out time is known , we can run find and get the list of modified files , again a user id.

             Is there a way to accomplish this upon user exit , using tools like tripwire seems like and over kill .

Regards,

P.S. This thread has been moved from HP-UX > System Administration to HP-UX > languages.
-HP Forum Moderator

[Dennis Handly]

What shell is being used?  A real shell or the scummy C shell?

Are you just looking at the files under the home directory or all of the filesystems?

[DeafFrog]

Hi Dennis ,

lokking for non vg00 fs and user shell is /sbin/sh.

Regards,

[RJHall]

You could insert a suitable 'trap' statement in your /etc/profile that will perform the task you want.

[Bill Hassell]

How much storage are you going look through? A small server with a few gigabytes will take a trivial amount of time. But HP-UX can easily be connected to petabytes of storage with billions of files, so the find command must be carefully designed to only look where the user has write capability. If the user is not restricted and there are millions of files to search, each exit might require an hour of intense disk activity.

Before designing the script, try find with selected directories and -mtime to find files changed in the last day or two, or for finer resolution, use the -newer option and a reference file. NOTE: if any of these users are sharing the same login, or worse, the user(s) have a root user UID, the find results will be only slightly useful.

[Dennis Handly]

>between the time a user login and log out.    If login time and log out time is known

It would be simpler to create a reference file when you login.  This can be done in your ~/.profile.

Then you can just can just use:

find fs1 fs2 ... -newer ~/.ref-file

You may want to see if the user removed the ~/.ref-file.  If this can happen, you would have to convert the login time to the touch command syntax to create the ref file.

Note: This is all modified files, no matter which user.

>You could insert a suitable 'trap' statement in your /etc/profile that will perform the task you want.

(This can also be put into each ~/.profile.)

trap "command any-parms" EXIT

[DeafFrog]

Thank you Dennis , RJHALL and Bill ,

I setteled for a script -a  file_name ,in .profile of the user , though upon login they will be aware of the same.

Regards,