Check to see how long it has been for a user to log in?

[Cindy Wolford]

Is there a file/log/something on HPUX 10.20 that will show users and there last successful login date/time?

[Andy Monks · Accepted solution]

Cindy

The 'last' command. who if they are still logged in.

[John Palmer]

You could try 'last' or 'last '
do 'man last'.

[Andy Monks]

Cindy

The 'last' command. who if they are still logged in.

[Andreas Voss]

Hi,

for history of succesfully logins use:
/usr/bin/last
for unsuccesfully logins use:
/usr/bin/lastb
NOTE: lastb only works if there is a file /var/adm/btmp
if you wish to use in future lastb just create the btmp file:
touch /var/adm/btmp
chmod 600 /var/adm/btmp

Regards

Andrew

[James R. Ferguson]

Hi:

# last -1

gives you a single entry of the most recent login for . If /var/adm/wtmp isn't present, touch it to make it and change its permissions to 644.

...JRF...

[Rick Garland]

Just like everybody says, the last command.
If you are wanting the info on a particular user, can use grep with the last command.

last | grep

[Cindy Wolford]

Thank you everyone for your help. I did the last command and it is what I want. Just one more question though:

At the end of the command, it says wtmp begins Fri Aug 18 08:22

What I was hoping to find is a list of all users and their last login....so if John Doe did not log in for 3 months, I would see user John Doe Fri MAY 18 and then I can research if John Doe still needs access to the system....etc.

Is there such a way?

[Andreas Voss]

Hi,

for some reason the /var/adm/wtmp was deleted/truncated at 18 Aug.
To look for MAY you have to look at your backups of this file.
If you have HP-UX 11.00 you can restore the wtmp file to a different directory and use last -f /wtmp.

Look at your cronjobs for anything that possibly truncates the file.

[John Palmer]

If you want to do this on a regular basis and also switch wtmp on a regular basis, you could consider 'touch'ing a file '//' in the user's
.profile (or /etc/profile).

The written date of the file would give you the last login time for that user.

[James R. Ferguson]

Hi:

In addition to Andreas' suggestion to look at cron entries to see where/when truncation occured, check SAM's logs too.

You, or perhaps someone else, may have used SAM to trim the wtmp file. This will be recorded in SAM's logs. Browse for this possibilty by selecting Routine Tasks -> System Log Files -> Options -> View Sam Log.

...JRF...