log file

[Jade Bulante]

I would like to find out where the log file is for login failures and attempts. We're running 11.00.

[Mark Greene_1 · Accepted solution]

they are here:

/etc/utmp
/var/adm/wtmp
/var/adm/btmp

see the man page for "last" for more info

HTH
mark

[Christopher McCray_1]

Hello,

Two places I can think of:

/var/adm/auth.log
/var/adm/sulog

Hope this helps

Chris

[Jade Bulante]

How can you read a wtmp or btmp file since it's considered an awk text.

[Mark Greene_1]

use last or ftwmp, but be careful as fwtmp has write capability.

mark

[someone_4]

You use 'last' and 'lastb' to read the files. See the man pages for 'last'.

cat /var/adm/wtmp | /usr/sbin/acct/fwtmp > /var/tmp/w>

or

last -10
gives you the lasat 10 entries

last -R -10

displays the hostname

same thing with lastb.

Richard

[someone_4]

/usr/sbin/acct/fwtmp < wtmp | more (view entire wtmp in ascii)

/usr/sbin/acct/fwtmp < wtmp | grep -eftp -eremshd | more (see if wtmp has
ftp or remsh contained in it)

/usr/sbin/acct/fwtmp < wtmp | grep -v -eftp -eremshd > wtmp.asc
(copy everything except ftp and remsh to an ascii file)

/usr/sbin/acct/fwtmp -ic < wtmp.asc > wtmp.bin
(convert ascii file to binary file)

last -f wtmp.bin
(use the 'last' command to view the binary contents of wtmp.bin)


cat /var/adm/wtmp | /usr/sbin/acct/fwtmp
fwtmp < /etc/wtmp > /tmp/filename

[Michael Tully]

You can also use grep as a filter to
analyse the output from either the
last or lastb commands.

e.g.
# last | grep fred (username)

[Christopher McCray_1]

to read a wtmp file, use the fwtmp command


Good luck
Chris

[Darrell Allen]

Hi,

One of my favorites is to use the who command against /var/adm/wtmp. See man who for more info but I like "who -a /var/adm/wtmp".

Darrell

[Sanjay_6]

Hi,

The first link gives a sample on how to read the info from the log files and the second link suggests what you can do to cleanup those log files,

http://us-support3.external.hp.com/cki/bin/doc.pl/sid=fe90b163102fbbb47b/screen=ckiDisplayDocument?docId=200000054497817

http://us-support3.external.hp.com/cki/bin/doc.pl/sid=fe90b163102fbbb47b/screen=ckiDisplayDocument?docId=200000058669444

Hope this helps.

Regds

[pap]

Hi Here are those files.

/etc/utmp
/var/adm/wtmp
/var/adm/btmp

Here is the explanation about those files.


A. File utmp contains a record of all users logged onto the system.

B. File btmp contains bad login entries for each invalid logon attempt.

C. File wtmp contains a record of all logins and logouts.

[Van Weyenberg Els]

Sanjay, I can't access the link you suggested above about cleanup /var/adm/wtmp. Also a search on document ID doesn't work. Maybe that's because I'm connecting from Europe. Is there another way to access this information ? Thank you.