turn on logout info

[RiclyLeRoy]

I'm able to trace login user in HP-UX B.11.00 setting in /etc/pam.conf in "authentication manager session" first row with "login" appending to it as option "debug".
Can you suggest me how to trace logout info ?

# Authentication management
#
login auth required ... debug

[Dennis Handly]

(Instead of creating three threads, please include all your related questions here.)

[RiclyLeRoy]

I'd like tracing session logout date for example telnet or ssh to syslog daemon.
What can I do ?

[George Spencer_4]

Either: use "last",
use the Extended history feature of AIX,
check out the accounting/audit system.

[RiclyLeRoy]

Hi Spencer,
I'm using HP-UX B.11.00, not AIX
I'd like feeding syslogd in real time that is every time event occurs it's immediately sent to syslogd daemon.
If I used the "wtmp" or "wtmpx" file by last command I should create script (e.g. running every hour) which extracts data from this file and it sends output to syslogd. It's not real time !
If I activated "audit system", I can get solution ?
What about Extended history feature ?
Now my problem is extracting user LOGOUT info.

[Dennis Handly]

>If I used the "wtmp" or "wtmpx" file by last command I should create script (e.g. running every hour) which extracts data from this file and it sends output to syslogd. It's not real time!

Then you just need to reduce the sleep time in your script to a minute or so.

>If I activated "audit system", I can get solution?

Not that I know of. Just more "massive" logfiles that you have to scan.

[RiclyLeRoy]

If I actived accounting/audit system:

1- Can accounting/audit system send logs to syslogd ?
2- Can accounting/audit system trace users logout ?

[OldSchool]

I know of no tool that will do this automatically.

You might be able to mess with the "trap" commands in /etc/profile so that on exit, the profile runs a "logger" command to place an event in syslog. the -p option would allow you to specify the facility and level, as in auth.info

just a thought

[RiclyLeRoy]

Oldschool,
thank you very much because your last suggestion is very useful.
Could you show me an example of "trap" command to insert into /etc/profile ?

[OldSchool · Accepted solution]

1) take a look at the existing /etc/profile, it enables and disables traps to keep the user from "breaking" out when the profile is running

2) do a "man" on the shell you're using, traps are noted in there