System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

How to determine last successful login

Victor Semaska_3
Esteemed Contributor

How to determine last successful login

Greetings,

Tru64 V5.1B w/ Patch Kit 5, enhanced security enabled.

I need to generate a list of accounts with their last successful login. I looked at the manpage for prpasswd and found field u_suclog. I logged into my account and checked my record with edauth and that field doesn't show up.

I checked the default record and this field is there, ':d_skip_success_login_log:'. So I assume that's why u_suclog isn't in my record.

I looked at the lastlogin command, ran it, and checked /var/adm/acct/sum/loginlog but found:
06-06-10 semaskav

Thing is when I either telnet or ssh it gives me the last successful login like this:
Last successful login for semaskav: Mon Aug 28 09:23:47 EDT 2006

So where is telnet & ssh getting the last successful login from?

Thanks,
Vic
There are 10 kinds of people, one that understands binary and one that doesn't.
2 REPLIES
Mark Poeschl_2
Honored Contributor

Re: How to determine last successful login

I'm guessing that the login command is smart enough to go to /var/adm/wtmp in lieu of the u_suclog field in the prpasswd database. See the man pages for 'wtmp' or 'last' for more details.
Victor Semaska_3
Esteemed Contributor

Re: How to determine last successful login

Mark,

Thanks for the info. That helps somewhat. Problem with 'last' is that we start new wtmp files at the beginning of every month. So if a user hasn't logged in during the current month we see no last login for that person.

We do keep previous monthly wtmp's amongst other files on tape so I could get them but that would be messy.

Thanks,
Vic
There are 10 kinds of people, one that understands binary and one that doesn't.