How to track user logins and activities?

[Joshua Goi]

Hi,

Is there a way to check (any) user login and logout times? And also, to see what files did this user accessed during this time?

Thanks!

[Stf]

you can have some information in /var/adm/syslog/syslog.log...

also look at this :

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=764349

Stf

[Moderator edit: The above link is no longer valid.]

[Joseph Loo]

hi,

use last (for successful login duration) and lastb (bad logins) command.

to see what files users access, unless u have audit turn on, another way is .sh_history from each user's home directories.

regards.

[Bharat Katkar]

Hi,

Is there a way to check (any) user login and logout times?

For users currently logged in use:

# who -R

For history of the user login sessions use:

# last -R

For unsuccessful login attempts use:

# lastb -R

Regards,

[Michael Selvesteen_2]

You could also use the auditing feature, This can be turned on thru 'sam'
Refer for more

http://docs.hp.com/en/B2355-90121/ch02s05.html

http://nixdoc.net/man-pages/HP-UX/man1M/audisp.1M.html

Note : Auditing is available only in trusted systems

All the Best.

[Moderator edit: The above link is no longer valid. Please refer to https://support.hpe.com/] 

[Sandman!]

Two log files keep track of successful and unsuccessful logins:

/etc/wtmp -- successful logins and logouts, accessed with "last".
/etc/btmp -- unsuccessful login attempts, accessed with "lastb".

/etc/wtmp exists by default and if the file /etc/btmp doesn't you can "touch" it if you're the superuser.

# touch /etc/btmp

As far as user activities are concerned do a man on the following commands:

lastcomm / acctcom / acctcms

cheers!

[Rick Garland]

login/logout times you can get through the `last` commands.

The `last` and `lastb`

As to what was accessed, check the user's .sh_history file. Also look at using the auditing feature of a trusted system.

[Juan M Leon]

Joshua. I concur with most of the people. By using acct feature will allow you to track different activities such as commands.
acctcom
lastcomm
acctcms
are most fo the commands that will help you to track activity in the system. You will need to enable acct by changing START_ACCT=1 in the /etc/rc.config.d directory.
Hope it helps.

[Andrew Cowan]

If you're really paranoid (and don't care too much about privacy issues) you can force users to connect via SSH and set the daemon logging to DEBUG. Be warned that this generates a LOT of traffic.

[Cem Tugrul]

Hi,
another link from me;
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=33516

[Moderator edit: Removed the invalid link.]

[muthamilan]

Hi

Use last command for sucessful login details,
use lastb command for unsucessful login details.I think lastb command only avilable on HP-UX.

[Q4you]

We had some lazy security guards, giving us hard time. So we asked them to turn and focus the cameras on user monitors. Now they monitor and track what they do !


Just kidding..