HPE Community read-only access December 15, 2018
This is a maintenance upgrade. You will be able to read articles and posts, but not post or reply.
Hours:
Dec 15, 4:00 am to 10:00 am UTC
Dec 14, 10:00 pm CST to Dec 15, 4:00 am CST
Dec 14, 8:00 pm PST to Dec 15, 2:00 am PST
cancel
Showing results for 
Search instead for 
Did you mean: 

turn on logout info

 
SOLVED
Go to solution
RiclyLeRoy
Frequent Advisor

turn on logout info

I'm able to trace login user in HP-UX B.11.00 setting in /etc/pam.conf in "authentication manager session" first row with "login" appending to it as option "debug".
Can you suggest me how to trace logout info ?

# Authentication management
#
login auth required ... debug
10 REPLIES

Re: turn on logout info

(Instead of creating three threads, please include all your related questions here.)
RiclyLeRoy
Frequent Advisor

Re: turn on logout info

I'd like tracing session logout date for example telnet or ssh to syslog daemon.
What can I do ?
George Spencer_4
Frequent Advisor

Re: turn on logout info

Either: use "last",
use the Extended history feature of AIX,
check out the accounting/audit system.
RiclyLeRoy
Frequent Advisor

Re: turn on logout info

Hi Spencer,
I'm using HP-UX B.11.00, not AIX
I'd like feeding syslogd in real time that is every time event occurs it's immediately sent to syslogd daemon.
If I used the "wtmp" or "wtmpx" file by last command I should create script (e.g. running every hour) which extracts data from this file and it sends output to syslogd. It's not real time !
If I activated "audit system", I can get solution ?
What about Extended history feature ?
Now my problem is extracting user LOGOUT info.

Re: turn on logout info

>If I used the "wtmp" or "wtmpx" file by last command I should create script (e.g. running every hour) which extracts data from this file and it sends output to syslogd. It's not real time!

Then you just need to reduce the sleep time in your script to a minute or so.

>If I activated "audit system", I can get solution?

Not that I know of. Just more "massive" logfiles that you have to scan.
RiclyLeRoy
Frequent Advisor

Re: turn on logout info

If I actived accounting/audit system:

1- Can accounting/audit system send logs to syslogd ?
2- Can accounting/audit system trace users logout ?
OldSchool
Honored Contributor

Re: turn on logout info

I know of no tool that will do this automatically.

You might be able to mess with the "trap" commands in /etc/profile so that on exit, the profile runs a "logger" command to place an event in syslog. the -p option would allow you to specify the facility and level, as in auth.info

just a thought
RiclyLeRoy
Frequent Advisor

Re: turn on logout info

Oldschool,
thank you very much because your last suggestion is very useful.
Could you show me an example of "trap" command to insert into /etc/profile ?

OldSchool
Honored Contributor
Solution

Re: turn on logout info

1) take a look at the existing /etc/profile, it enables and disables traps to keep the user from "breaking" out when the profile is running

2) do a "man" on the shell you're using, traps are noted in there
RiclyLeRoy
Frequent Advisor

Re: turn on logout info

I added /etc/profile trap command to capture signal 0 (exit from shell)