last command on a network

[MarkSyder]

Hi everybody,

I have been asked to identify users on our network who haven't logged in for over 90 days. I know I can do this with "last|grep userid", but don't want to have to log in to every server/workstation for every user. As the users are set up in NIS, I am sure there must be a way of doing it from the NIS server.

Any ideas?

Mark Syder (like the drink but spelt different)

[Robert-Jan Goossens]

Hi Mark,

How about the finger command.

# finger user

Robert-Jan

[Karthik S S · Accepted solution]

Hi Mark,

Though the user login information is obtained from the NIS, the system still keeps the login activities in the local files (utmpx/wtmpx). I would suggest you to write a script that can do a remsh to all the systems, run last command and redirect the o/p to a file. If you feel this is a security risk then you have to do this on individual systems ..

-KarthiK S S

[MarkSyder]

Thanks for the prompt replies.

I'll give them both a go and award points accordingly.

Mark

[Mark Grant]

No, there isn't, unless of course you have your utmp/wtmp files synchronised with NIS :)

[MarkSyder]

Karthik - I'm not ignoring you, I just haven't had time to check your solution yet. I will award your points when I've tried writing the script and know the result.

Robert-Jan - thanks, I've tried it, but it still means logging in on every server/ws.

Mark

[Karthik S S]

Mark,

That is OK .. take your own time :-))

-Karthik S S

[Karthik S S]

Install expect script from,

http://hpux.connect.org.uk/hppd/hpux/Tcl/expect-5.39/

And sitting from a workstation run the following script (slight modification required - you can login as root or any normal user - a file by name server_list should be created which will contain a list of machine names),


for i in `/usr/bin/cat server_list`
do
/usr/sbin/ping $i
if [ $? -eq 0 ]
then
/usr/local/bin/expect <set prompt "(%|#|\\$|<|>)"
set timeout 10
spawn telnet $i
expect "Login: "
send "root\r"
expect "Password: "
send "password\r"
expect "$"
send "last | grep user\r"
expect "$"
send "exit\r"
exit
EOF
else
/usr/bin/echo "$i is down"
fi
done > userstat.out

Hope this helps...

-Karthik S S

[Karthik S S]

You can replace telnet with rlogin/remsh which will be much faster.

No points for this please ..

-KarthiK S S

[MarkSyder]

Thanks Karthik.

The file is being created as I write.

I think I'll probably leave it running overnight - it looks as though it's going to be big.

Mark