HPE Community read-only access December 15, 2018
This is a maintenance upgrade. You will be able to read articles and posts, but not post or reply.
Hours:
Dec 15, 4:00 am to 10:00 am UTC
Dec 14, 10:00 pm CST to Dec 15, 4:00 am CST
Dec 14, 8:00 pm PST to Dec 15, 2:00 am PST
System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

Can i find all system logins/authentications for the last year?

 
jmckinzie
Super Advisor

Can i find all system logins/authentications for the last year?

Is there any way to get all authentications for the last year?
5 REPLIES
Steven E. Protter
Exalted Contributor

Re: Can i find all system logins/authentications for the last year?

Shalom,

lastb
last

The first is bad logins
The second is good logins

The souce data for these files in order is:
/var/adm/btmp
/var/adm/wtmp

If those files have not been emptied the past year, the data is there.

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
Manas Shukla
Occasional Visitor

Re: Can i find all system logins/authentications for the last year?

Hi,

Don't open the files btmp and wtmp through vi else the files will be corrupted and not readable.

Always use last and lastb commands to see the details.


Thanks
Mel Burslan
Honored Contributor

Re: Can i find all system logins/authentications for the last year?

As SEP said, last and lastb are the commands to show you logins and filed login attepts to your system, unless of course your wtmp and btmp files gets cleared out periodically. If you have good backups, you can see how far back they go and pull out a tape from your archive, closer to that date, restore these two files and keep digging until you reach your desired 1 year period or longer if you wish. Otherwise, if these log files get truncated or written over, you are out of luck
________________________________
UNIX because I majored in cryptology...
Steven Schweda
Honored Contributor

Re: Can i find all system logins/authentications for the last year?

> Don't open the files btmp and wtmp through
> vi else the files will be corrupted and not
> readable.

_Reading_ a file using "vi" corrupts it?
Really???
Prashantj
Valued Contributor

Re: Can i find all system logins/authentications for the last year?

Hi,

use this last -R root | head -5

Thanks
Prashant
Good judgment comes from experience and experience comes from bad judgment.