Last Login Information

[Scott E Smith]

I am attempting to create a report of the last logins (successful) for all of the users on our servers. Using the "last" command I just keep getting a lengthy list of all successfull logins in the audit files. How can I limit the returned data to just the most recent successful login?

[Andrew Lartey]

I guess you could grep for particular date or dates.

other thing to do is roll the log file over once a week (or however often you consider recent logins to be)

/var/adm/wtmp

[CHRIS_ANORUO]

Try last -R -count were count could be any number.

eg last -R -50

Cheers

[Paul Hite · Accepted solution]

How about:

#! /usr/bin/ksh
cat /etc/passwd | sed 's/:.*//' | while read user ; do
last $user | sed 1q
done | grep -v "wtmp begins" | ssp
exit 0

If you're using nis, "cat /etc/passwd" becomes "ypcat passwd".

[Duane Gorder]

Try the following. It gets a list of all the ids in /etc/passwd, then checks each one with the "last" command and takes only one answer from the "last" command for each passwd entry.

awk -F: '{print "last | grep " $1
" | head -1"}' /etc/passwd | ksh -

[Duane Gorder]

My previous answer should be all on one line or have a continuation character.
Try the following. It gets a list of all the ids in /etc/passwd, then checks each one with the "last" command and takes only one answer from the "last" command for each passwd entry.

awk -F: '{print "last | grep " $1 " | head -1"}' /etc/passwd | ksh -