System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

List of Users who login the server

Junghun
Occasional Advisor

List of Users who login the server

Hi
I have some quetions about the list of users who logged in the server.
1.The var/adm/utmp file record the user who still logged in the server,and the "w" is also display the user who logged in the server.But the Two is not all the same.Some of the users in the utmp list is already loggded out.why this happen?
2.Sometimes the "w" command displays the user who have already logged out long time ago.why this happen?
3.sometimes the list that "w" command displays does not cotain the ip who logged in the server.why this happen?
4.The auth.log in the syslog is record the times when the root user logged in the server,is that right?Then why the list of auth.log and wtmp log do not match?
Thanks
Junghun
3 REPLIES
Venkatesh BL
Honored Contributor

Re: List of Users who login the server

What is the OS & patch version?
Junghun
Occasional Advisor

Re: List of Users who login the server

OS:Tru 64 V5.1.B
Oracle:8.1.7.4

Patches installed on the system came from following software kits:------------------------------------------------------------------

- T64KIT0024519-V51BB25-E-20041218 OSF540
- T64V51BB24AS0003-20030929 OSF540
- T64V51BB25AS0004-20040616 OSF540
- T64V51BB25AS0004-20040616 TCR540

Thanks
--Junghun
Ivan Ferreira
Honored Contributor

Re: List of Users who login the server

1- I think that the file that you should use /var/adm/wtmp (The login/logout database file )

2- I think that the system did not record the logout because the user disconnected the session without exit/logout.

3- Maybe somebody su to that user?

4- You should disable root access, allowing only the use of certain users in the group system to su to root.

Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?