User Logs.

[Girish_84]

Hi,
How would I get ALL the information about Users logged in and out. Specifically, the login names and in-out timings.

Also, can I checked what activities they performed while they were logged in.

[Roopesh Francis_1]

you can use last command. The last command searches backwards through the file /var/adm/wtmp (which contains a record of all logins and logouts) for information about a user, a tty, or any group of users and ttys. Arguments specify names of users or ttys of interest. The names of ttys can be given fully or abbreviated. For example, last 0 is the same as last tty0. If multiple arguments are given, the information that applies to any of the arguments is printed. For example, last root console lists all of root's sessions as well as all sessions on the console terminal. The last command prints the sessions of the specified users and ttys, most recent first, indicating when the session began, the duration of the session, and the tty on which the session took place. last indicates if the session is still in progress or if it was cut short by a reboot.

[Robert-Jan Goossens_1]

Hi,

Try the last command. If the users have the HISTORY environment variable enabled you can search the /$HOME/.sh_history file for commands they have used.

Regards,
Robert-Jan

[SoorajCleris]

Hi Gir Dix,

1 Ans: You may use /var/adm/wtmp file to check the successful login info.
/var/adm/btmp for unsuccessful logins.

2 Ans: you may check the history file in the home directory of user to see the commands usesd.

Regards,
Sooraj U

[Suraj K Sankari]

Hi,
As above said "last" is the command to see the users login and logout details for commands you can check users .history file.

using third party software you can get the details or you can enable auditing, through auditing also you can get all the details at your server.

Suraj

[Girish_84]

thank you everybody, it was a great help!