Account/File/Directory creation time

[Joe Choo]

Hi all,

Do you have any idea of how I can find out when a unix login account was created ? Same question applies for when a file/directory was created ?

Thanks
Joe

[A. Clay Stephenson]

No matter what you are told, it isn't possible. UNIX has no concept of the creation time of a file, (including directories), or logins. If you want to keep up with when accounts are created or removed, you must create your own database to do so --- and you must do this beforehand. You can look at some of the timestamps such as modification or change time of files in the users' home directories but if these happen to be the file creation time, it's only by accident.

[Joe Choo]

noted, thanks!!

[Raj D. · Accepted solution]

Joe ,

You can check this :

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1000327&admit=-682735245+1153198246237+28353475


Cheers,
Raj.

[Joe Choo]

Great! Thanks!

[Arunvijai_4]

Hi Joe,

Check my thread : http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=956122

-Arun

[Bedare Nikhil]

I guess this can be the solution to know when the account was created.
When the account is created,a .profile file is created for that account.If we use
"ls -al accountname" we get the listing of the .profile file also which includes the timestamp for the .profile file.This timestamp is the same as the timestamp when the account was created.

[Patrick Wallek]

Nikhil,

That *MIGHT* work, but it assumes that the .profile has not been changed since the account was created. That could be a very dangerous assumption.

The bottom line is that there is NOT a guaranteed surefire way to get account creation time.

A method to track it *COULD* be implemented by putting a date/time in the GECOS field in the /etc/passwd file when users are created. Again though, anyone with proper authorization could modify that.

[Joe Choo]

Thanks