How to find out the logins

[Suni Raj]

Hi...

Someone(obviously with preveliged user) restarted the Sybase DB on my HP-UX 11.0 box. How can I find that who has done this or who was logged on to the server at a particular time.

Can anybody help me out in this regard.

Regds
Suni

[Muthukumar_5 · Accepted solution]

last -R

will give it.

hth.

[Pete Randall]

The last command will give you login info.


Pete

[RAC_1]

last -R - successful logins
lastb -R - invalid logins

[Arunvijai_4]

# last will be helpful. Use # last -R to get user's hostname.

-Arun

[Rita C Workman]

last will tell who logged in and when.
But you need to take note who may still have been logged in at that time.

Suppose depending on your environment, and depending on how many folks have access to stop/start DB's, your going to have to narrow down who it 'could have been'.

Rgrds,
Rita

[Borislav Perkov]

Hi Suni,

#last -R
and you will find who was logged but also look in /var/adm/sulog to see if he used the su command to user who is able to restart the Sysbase DB,

Regards,
Borislav

[Morcos]

last will be helpful in this case.

/var/adm/wtmp : login database.

Hope this helps

Ziad

[Muthukumar_5]

Another way is simply (if you enabled history file) then,

cd /home
for file in `find . -type f -name "*history*"`
do
grep 'sybase-stop related string' $file
done

hth.