how to create a list of users that didn't logon for the past 6 months?

[Kelvin Ng]

Hi,
how to create a list of users that didn't logon for the past 6 months?

Thanks & Regards,
Kelvin

[Patrick Wallek]

Is your system trusted?

If so, I have a script at the office that will do this for trusted systems.

[Kelvin Ng]

Hi Patrick,
what do you mean by trusted system? it is HP-UX 11.0i production server

Thanks & Regards,
Kelvin

[Hakki Aydin Ucar · Accepted solution]

Probably you have untrusted standard system when it look your OS version, but you can check it by issuing the command;

ll -d /tcb

/tcb not found
# means it is NOT TRUSTED System

[Hakki Aydin Ucar]

http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=109447626+1283624873925+28353475&threadId=606819

[Dennis Handly]

>what do you mean by trusted system?

Trusted is one method of where the passwords are stored. If you don't know about that, it probably isn't enabled?

(Being trusted would allow you to collect this info easier.)

You could use last(1) and then find IDs that don't appear in the first 6 months.

[Kelvin Ng]

Hi Hakki
ll -d /tcb resulting /tcb not found
our system is NOT TRUSTED System


Hi Dennis,
You could use last(1) and then find IDs that don't appear in the first 6 months.
Kelvin: how? what is the argument?

Thanks & Regards,
Kelvin

[Dennis Handly]

>how? what is the argument?

There really isn't any useful argument to last(1), you must write a script to process the output up to 6 months.

[Kelvin Ng]

i try with finger -i username but it didn't showed idle time

[James R. Ferguson]

Hi Kelvin:

As already noted, you will need to examine the '/var/adm/wtmp' file [which is the data repository for login activity ' ].

If this file hasn't been trimmed during the last 6-months, it will have the user population that you want. Actually, it will contain records for users that *have* logged in.

One simplistic way to find the users who haven't logged in is to use 'last name' where 'name' is the account name read from '/etc/passwd'. If no records are found for the account name, then that account did not login within the time frame represented by the 'wtmp' file.

Regards!

...JRF...

[Bhadresh]

Hi Kelvin,

Have a look at following threads:

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=240819

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=150881

Regards,
Bhadersh

[Kelvin Ng]

Thanks guys, i managed to find those users account that has not been login for past 3 months.

Regards,
Kelvin

[Dennis Handly]

>JRF: One simplistic way to find the users who haven't logged in is to use "last name"

Yes but very slow and it will have to read the file for each user.

[James R. Ferguson]

Hi (again):

> Dennis: Yes but very slow and it will have to read the file for each user.

Yes, of course. That's why i used the word "simplistic". For performance, I'd probably use a Perl hash (associative array) to hold the account names seen by running 'last()' once. Then, walk '/etc/passwd' testing each account name for its presence in the hash. Existence in the hash means that the account has had activity, so skip reporting it. The absence of an account in the hash signifies a user without activity and that's a name to list.

Regards!

...JRF...

[Hakki Aydin Ucar]

it is good idea to use in Perl arrays, OR more easier in not busy hour of system they can be collected with a cronjob ,preferably after midnight like ;

# last > /tmp/last.file ## This run inside cron
# cat /tmp/last.file |awk '{print $1,$3,$4,$5}'| grep -E 'User_We_Look_For|Jun 23'

just an idea derived from JRF 's idea..