HPUX 10.20: Last User Login

[LG Porter]

I have several K-Class servers that I manage running HPUX 10.20. I would to determine the last time each user logged into the system on each of these servers or the last date used. Is there another method to extract this information other that using the 'last -R' command? This information is usally contained in the wtmp. This there another log that my contain this information?

[Chris Wilshaw · Accepted solution]

last -R is the main one, although if you clear out your wtmp file, you lose the info.

If you need a different way of doing it, change /etc/profile and /etc/csh.login so that at the end of each, it does a

touch $HOME/.lastlogin

This then creates a file called .lastlogin in each users home directory which you can then use to see when the last logged in.

[John Palmer]

Hi,

You could try the last accessed date on their .profile but it's not foolproof.

wtmp *is* the logfile that contains this information but it's good practice to tidy it regularly so you could lose information.

How about amending /etc/profile or .profile to simply write the current date/time to a file based on ${LOGNAME}.

Regards,
John

[Paul Sperry]

why not just look at the date of the users
.sh_history file?

[John Palmer]

Hi Paul,

I initially thought of that but it's going to be the time they logged out (or issued the last command if still logged in) rather than the time they logged in. It does match the requested criteria 'or the last date used' though.

Regards,
John

[Chuck J]

I would've said the same as John, check the last date used of their .profile file:

# ls -ltu /home/chuckj/.profile

For future, you could write a script that gets executed via /etc/profile that creates a file with the data you require.

Or, if you want to do it for all users at this polint in time you could write a script that something like:

cd /home
for user in *.*
do
ls -ltu /home/chuckj/.profile >> /tmp/lastlogin

etc...

Chuck J

[Chuck J]

I would've said the same as John, check the last date used of their .profile file:

# ls -ltu /home/chuckj/.profile

For future, you could write a script that gets executed via /etc/profile that creates a file with the data you require.

Or, if you want to do it for all users at this polint in time you could write a script that something like:

cd /home
for user in *.*
do
ls -ltu /home/$user/.profile >> /tmp/lastlogin

etc...

Chuck J

[Shannon Petry]

All Unices have Berkely System Accounting on them or available. Solaris, AIX, and Linux have it is add on products, but Irix and HP-UX have built in accounting.

In most sites, I run accounting even if I dont really use it. It keeps the /var/atm/*tmp files clean, as well as gets me info when I need it.

man accounting

It's relatively simple to setup.
change /etc/rc.config.d/acct file START_ACCT=0 to START_ACCT=1.

Run /usr/sbin/acct/turnacct on

The man pages will tell you what to run in cron, as well as other utilities you can use to extract data from reports.

The only thing the man pages dont tell you, is that you need to periodically clean up /var/adm/acct/sum, especially if your running daily accounting.

Accounting gets you lots of info, and in my opinion is worth setting up on all systems mainly because I have information when I need it for processes that ran, who the cpu hogs are, disk hogs, last logins, etc...

Regards,
Shannon