check user login date on a system

[kacou]

I create some users on my hp-ux server (cluster) (B.11.23). What command can I use to check if they connected once on my system?
I use ‘last command’ but it’s to long

[James R. Ferguson]

Hi:

> I use â last commandâ but itâ s to long

Why not (?):

# last -1 kacou

...which gives the last (latest if any) entry.

Reagrds!

...JRF...

[kacou]

i did

#last -1 Hennie

I have any result whereas he was connected once at least.

[James R. Ferguson]

Hi (again):

> I have any result whereas he was connected once at least.

That is exactly what you will get --- one event where the event is the last login (if any is available in the '/var/adm/wtmp' log.

You can check for the earliest possible timestamp in your log with:

# last xxxxxx

You might see:

wtmp begins Thu Jan 31 15:17

You could also use:


#!/usr/bin/sh
MYWTMP=/var/adm/wtmp.backup #...change me...
OLDIFS=${IFS}
IFS=":"
while read USER X
do
last -1 ${USER} -f ${MYWTMP}|grep -Ev "^$|^wtmp begins"
done < /etc/passwd
IFS=${OLDIFS}
exit 0


...This will produce one-line output for every user in your '/etc/passwd' with an entry in your 'wtmp' backup. Only the most recent login information (one line per user) will be printed.

Regards!

...JRF...

[Steven E. Protter]

Shalom,

Well maybe once in a while trim the /var/adm/btmp and /var/adm/wtmp files


>/var/adm/btmp
>/var/adm/wtmp

Or if we are looking for a particular user.

last | grep username

SEP

[Suraj K Sankari]

Hi,

you can use last -R | grep still
or
who -u will tell how many user's are currently login into the box.

Suraj

[Sandeep_Chaudhary]

hpux034 # last login sandchau
sandchau pts/0 Fri Sep 19 08:24 still logged in
sandchau pts/0 Mon Sep 8 08:54 - 09:11 (00:17)
sandchau pts/2 Wed Aug 27 11:27 - 14:54 (03:26)
sandchau pts/0 Tue Aug 12 07:18 - 07:19 (00:01)
sandchau pts/0 Tue Aug 5 15:56 - 15:56 (00:00)
sandchau pts/0 Wed Jul 16 07:07 - 07:08 (00:01)
sandchau pts/0 Thu Jul 3 06:09 - 06:29 (00:19)
sandchau pts/0 Mon Jun 9 13:57 - 08:05 (18:08)
sandchau pts/0 Tue Jun 3 12:49 - 06:20 (17:31)
sandchau pts/0 Fri May 23 12:05 - 12:19 (00:14)
sandchau pts/1 Thu May 22 14:15 - 14:11 (84+23:55)
sandchau pts/0 Wed May 14 05:48 - 14:11 (93+08:22)
sandchau pts/0 Fri May 9 13:16 - 00:18 (1+11:02)
sandchau pts/0 Wed Apr 16 14:58 - 00:18 (24+09:20)
sandchau pts/0 Wed Mar 26 11:37 - 11:37 (00:00)
sandchau pts/0 Tue Mar 25 08:30 - 11:10 (1+02:39)
sandchau pts/0 Mon Mar 17 07:52 - 00:18 (54+15:26)
sandchau pts/0 Sun Mar 16 16:23 - 16:27 (00:04)
sandchau pts/0 Sat Mar 15 22:36 - 22:40 (00:04)
sandchau pts/1 Sat Mar 15 17:53 - 18:06 (00:13)
sandchau pts/0 Sat Mar 15 13:27 - 18:10 (04:43)
sandchau pts/0 Sat Mar 15 11:01 - 13:08 (02:06)
sandchau pts/0 Mon Mar 10 06:45 - 18:10 (5+11:25)


WTMPS_FILE begins at Thu Feb 16 22:51:20
sandchau as root@hpux034 [/root]


hpux034 # last logins czyzewsk

WTMPS_FILE begins at Thu Feb 16 22:51:20
sandchau as root@hpux034 [/root]


Is this what u expected

[Sandeep_Chaudhary]

if yes then to check fr all user:

for i in `cat /etc/passwd|cut -d ":" -f 1`
do
last logins $i
done

[HCL123]

Dear
check in
var/adm/btmp
var/adm/wtmp

and if you want for particular user.

last | grep username

[B V B Kumar]

Hi,

If you want to see the currently logged users with following command.
#who -R

or if user is already logged out, check /var/adm/wtmp file. Successful users information will logged in that file.

regards
Kumar

[praveen_kp]

hi,

check ur syslog file

tail -100 /var/adm/syslog/syslog.log | grep "Sep 12"

above i have just gave one example

thanks
praveen

[Bill Hassell]

You wrote:

> i did
>
> #last -1 Hennie
>
> I have any result whereas he was connected once at least.

Did you mean that you did not have any output? No output means that the user ID Hennie did not login since the wtmp log file wasa started. Verify this with:

last | grep Hennie

Spelling counts. You might also try:

last | grep -i hennie

It is useful to see where a user came from by using -R as in:

last -R | grep -i hennie