last and finger command

[Suresh Manimandiram]

I am looking for the Last login time of all users in my hp UNIX system. I was initially trying to use last command, but last do not give any YEAR even if it is not the current year. So I used finger command, which gives the year if it is not current year. Is there any other easy way to get this information including year?

Sometimes finger gives the output “Never logged in” (for which last does not give any output at all). In that case how do I know this is true since when? My understanding is that these commands get this information from wtmp file. How can I know what is the earliest date this file has the data? I have seen the very last command for last is something like this “wtmp begins Mon Feb 16 16:17”. Again there is no Year there.
Any help would be appreciated

Thanks
Suresh

[Pete Randall]

How do they login? If they log in to CDE, for example, the timestamp on the ~/.dt directory will be updated. You could use the touch command to set them all to some arbitrary date and, if they changed, you'll know when they logged in.


Pete

[Bharat Katkar]

suresh normally HPUX doesn't give YEAR if it is cuurent year. If it is older than year then only it will display year otherwise not.
Don't know all options that can be used with last but you can always have a look at "man last" and "man finger"
Regards,

[Suresh Manimandiram]

Users can login through CDE as well as through application.
I understand the issue with the YEAR and that is not a problem. I can get that from finger.
The question I have now is how can I get the starting date of this login information data the system keeps in wtmp or something like that. that has nothing to do with a single user. But is the oldest date the system has the login information.

[James R. Ferguson]

Hi Suresh:

You are correct, 'last' reports its dates *without* any year. The data, indeed, comes from /var/adm/wtmp.

The initial heading from a 'last' query does (at least) identify the date at which the file begins. That is, if you redirect /dev/null to /var/adm/wtmp to clear it, then the date and time at which you do that is reflected in 'last's "begins..." announcement.

It is generally expected that you will periodically null the 'wtmp' file so that it doesn't grow without bound.

Regards!

...JRF...

[James R. Ferguson]

Hi Suresh:

HOWEVER, you can periodically convert your /var/adm/wtmp file from a binary file to an ASCII one; save it and truncate the current 'wtmp' binary file.

The advantage for you is that the ASCII version expands the timestamp into a full date with the year.

# /usr/sbin/acct/fwtmp < /var/adm/wtmp > mylogindb

Regards!

...JRF...

[Rodney Hills]

Here is a perl script that reads wtmp and outputs the date with the year

# this is the template we're going to feed to unpack( )
$template = "A8 A4 A12 l s s s s l a16 l";
# this uses pack( ) to help us determine the size (in bytes)
# of a single record
$recordsize = length(pack($template,( )));

# open the file
open(WTMP,"/var/adm/wtmp") or die "Unable to open wtmp:$!\n";

# read it in one record at a time
while (read(WTMP,$record,$recordsize)) {
# unpack it, using our template
($user,$ttyid,$tty,$pid,$type,$term,$exit,$time,$host,$hostip)=unpack($template,$record);
next unless $type == 7;
next unless $ttyid;
next if $ttyid eq "ftp";
next if $ttyid=~/\d+:\d+/;
$user=~y/\000//d;
$ttyid=~y/\000//d;
$tty=~y/\000//d;
$host=~y/\000//d;
print join(",",$user,$ttyid,$tty,$pid,$time,$host),"\n";
}

HTH

-- Rod Hills

[Vibhor Kumar Agarwal]

You can add a line in the .profiles or .dt_profiles.


date >> log_file

[Muthukumar_5]

You can do scripting with /etc/profile as,

echo `who -mu;date +'%Y'` | awk '{ print $1,$2,$3,$4,$9,$5 }' >> /var/adm/login.log

hth.