Login Information

[Waqar Razi]

I have recently trimmed my wtmp file just as part of monthly cleanup but I do have the backup of the old file. Now the management needs the record of when was the last time when each user on that system logged in?

How can I use the old wtmp file along with the current one to get this report done?

[Pete Randall · Accepted solution]

The last command will search through the wtmp file. You can also specify the -f option in order to specify that it search through your backup wtmp file.


Pete

[Deepak Kr]

Hi Razi,


You give following:


#lastb -f

where:

-f file Use file as the name of the accounting file instead of /var/adm/wtmp or /var/adm/btmp.

[Pete Randall]

Ummmmmm . . . . . the lastb command reports bad logins - I believe the report needs to be good logins.


Pete

[Steven E. Protter]

Shalom,

Prior to trimming the file, it might pay to make a backup if management wants records from the distant past.

the lastb command gives non-binary output to /var/adm/btmp and the last command does the same for /var/adm/wtmp

Note that -r option gives the remote IP address, which is standard output in the Linux version of the utility.

passwd -sa might provide good data to cross check against manually

SEP

[James R. Ferguson]

HI Wagar:

You could do something like this:

#!/usr/bin/sh
MYWTMP=/var/adm/wtmp.backup #...change me...
OLDIFS=${IFS}
IFS=":"
while read USER X
do
last -1 ${USER} -f ${MYWTMP}|grep -Ev "^$|^wtmp begins"
done < /etc/passwd
IFS=${OLDIFS}
exit 0

...This will produce one-line output for every user in your '/etc/passwd' with an entry in your 'wtmp' backup. Only the most recent login information (one line per user) will be printed.

Regards!

...JRF...

[Dennis Handly]

>if I have a user steve and he logged in for the last time one week before, output should be like that:

Here is a script something like JRF's script in your other link:
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1263622

The output looks like:
root 0 0 0 Wed Aug 27 13:13

Note this just checks the current system with last(1).

sort passwd1 passwd2 passwd3 | awk -F: '
function do_print() {
save_line = name " " uid
last_command = "last -1 " name
name = $1; uid = $3
FS=" "
xx = last_command | getline
if (xx == 1)
print save_line, $3, $4, $5, $6
else
print save_line, "???"
FS=":"
}
BEGIN { getline; name = $1; uid = $3 }
{
if ($1 == name) {
uid = uid " " $3
} else {
do_print()
}
}
END { do_print() } '