How to determine last successful login

[Victor Semaska_3]

Greetings,

Tru64 V5.1B w/ Patch Kit 5, enhanced security enabled.

I need to generate a list of accounts with their last successful login. I looked at the manpage for prpasswd and found field u_suclog. I logged into my account and checked my record with edauth and that field doesn't show up.

I checked the default record and this field is there, ':d_skip_success_login_log:'. So I assume that's why u_suclog isn't in my record.

I looked at the lastlogin command, ran it, and checked /var/adm/acct/sum/loginlog but found:
06-06-10 semaskav

Thing is when I either telnet or ssh it gives me the last successful login like this:
Last successful login for semaskav: Mon Aug 28 09:23:47 EDT 2006

So where is telnet & ssh getting the last successful login from?

Thanks,
Vic

[Mark Poeschl_2]

I'm guessing that the login command is smart enough to go to /var/adm/wtmp in lieu of the u_suclog field in the prpasswd database. See the man pages for 'wtmp' or 'last' for more details.

[Victor Semaska_3]

Mark,

Thanks for the info. That helps somewhat. Problem with 'last' is that we start new wtmp files at the beginning of every month. So if a user hasn't logged in during the current month we see no last login for that person.

We do keep previous monthly wtmp's amongst other files on tape so I could get them but that would be messy.

Thanks,
Vic