Auditing user telnet login.

[Alexey_21]

Hello!

I need to know users telnet login (succesfull or not) for last month. How can i do it with minimum system audit? Can `login` self-auditing?

system: HP-UX Release 10.
sorry for bad english.

[Massimo Bianchi]

Hi,
you can find infos:
- in the syslog
- using the command "last" or "last -b"

This can be done without any change to your system.

HTH,
Massimo

[Michael Tully]

The 'last' command tracks successful logins. These are obtained from /var/adm/wtmp file.

The 'lastb' command tracks unsuccessful login attempts. These are obtained from /var/adm/btmp file.

As long as your system keeps the logs for the last month you should be okay. If the logs are rolled over (removed by a script usually via cron) then you may have to restore them from backups.

Regards
Michael
"When I have trouble spelling, it's called fat finger syndrome"

[Zeev Schultz]

once a month you can trim the files by
first copy them to specified directory like this:
cp /var/adm/[b,w]tmp $DIR/$MONTH
then to trim the original:
cp /dev/null /var/adm/[b,w]tmp.
Can read the saved files with -f $FILE option.
However /var/adm/wtmp can become corrupted sometimes.