How do I find out what users have logged in, and when.

[Chet Woods]

Hi all,
I just wondering if anyone could help me out. I need to be able to find out if and when a user logged in. OS is 10.20. Any suggestions would be great.

Thanks,
Chet

[Jason VanDerMark]

I don't know if this is what you are looking for or not, but you can type the command 'who -u'. This will show you who is logged in and when they logged onto the system. There are lots of things that who can do, you may want to refer to the man pages for any of the other options. Hope this is what you were looking for.

Regards,
Jason V.

[Jason VanDerMark]

I forgot to type the H into the command it should look like this for greatest readability:

who -uH

Regards,
Jason V.

[Chet Woods]

Actually, I'm looking for a log of some sort that would show a user logged in say, a week ago, at a certain time. Not necessarily who is logged in right now.

thanks

[James R. Ferguson · Accepted solution]

Hi Chet:

Use 'last' (see 'man last'). If /var/adm/wtmp is present, then this file will contain a record of all logins. Do this:

# last

If /var/adm/wtmp isn't present, then you will need to first touch it to start collecting this information. Permissions should be 644 owned by root. Trim (or create) the file by redirecting /dev/null into it:

# /dev/null > /var/adm/wtmp

Bad login attempts are (corresponding) kept in /var/adm/btmp and are interrogated with 'lastb' [see same man as above].

...JRF...

[Chet Woods]

Thanks, that worked. Although it must "reset" after every reboot. Is that true? The log only goes back to Monday (server rebooted every Sunday morning).

[James R. Ferguson]

Hi Chet:

If /var/adm/wtmp is being nulled every week then I suspect that you are running accounting processes, otherwise the file will grow without bound unless you (or cron, or some local startup script) trim it.

If accounting is active, 'START_ACCT' will be equal to <1> in /etc/rc.config.d/acct otherwise it will be set to <0>.

See also: 'man 1M acctsh'

...JRF...

[Satish Y]

Try command
finger

Cheers...
Satish.

[Satish Y]

sorry i didn't go through complete mails... last is the appropriate command...


Cheers....
Satish.