Analysis user log files

[ajk_5]

Dear all,

I use command "who -u" capture a file in the cron job daily that wants to analysis which users didn't login to the system more than 3 months. How can I use those daily log files to do the result?
Thanks!

Best Regards
Ajk

[twang]

In your case, I think you can simply usr "last" to find out who logged onto the system in the past 3 months and use "listusers" to list all users, then compare both files to find out who didn't login more than 3 months.

[ajk_5]

Hi Twang,

I don't know how to do it. Would you mind to tell me in detail, please?

Best Regards
Ajk

[Michael Tully]

You should be able to do this as long as the data files that store this information have not been removed or changed (purged within your timeframe. (/var/adm/wtmp and /etc/utmp)

Have a look at a very similar discussion from earlier today.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x53650ea029a2d711abdc0090277a778c,00.html

The 'last' command uses the same data file (/var/adm/wtmp) as 'who -u'

[ajk_5]

How can I find out the result from those information in a unix script?

[T G Manikandan]

check this link

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x9ba3ee3e323bd5118fef0090279cd0f9,00.html

[Sridhar Bhaskarla]

Hi Ajk,

There isn't a simple way of finding this out. If you want to find this out, the best way is to use last command. However, this pulls out the information from wtmp. So, if you trimmed it anywhere in the last three months, then you won't get the information. So, you will have to plan. Either keep the wtmp file for 3 months or regularly recycle (using /usr/sbin/acct/fwtmp
) but keep the old files somewhere.

Then it is just a question of writing a script that can take care of it.

last -R > last.log

(Edit this and remove standard logins like root, bin, sys etc., or you can put a grep -v in the above)

for LOGIN in $(awk '{FS=":";print $1}' /etc/passwd)
do
grep -q $LOGIN last.log
if [ $? != 0 ]
then
echo $LOGIN >> nologin.out
fi
done

if [ $(wc -l nologin.out|awk '{print $1}') -eq 0 ]
then
echo |mailx -s "No LOGINS" your_id@yourdomain.com
else
mailx -s "NO LOGIN REPORT" yourid@yourdomain.com < nologin.out
fi


-Sri