monitoring user login in period of days

[Ahmed Hassan_1]

I had a running aplication on HP UX 10.20;
I think a lot of my user in the unix os not login from long time before;I want to see the user who loged in from specific dat;which file contains these logs information?and how i can edit it if it is text or how to convert it to a text file?is there any unix comand to sort the result by date?
I hope to recieve reply fast
ahmed

[T. M. Louah]

Hi Ahmad,
here an interesting Thread about command "last -R" which by default sort output by date:
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xf35d039599eed5118ff40090279cd0f9,00.html

g'd luck.
T++

[Darrell Allen]

Hi Ahmed,

last displays when users logged in by date

lastb displays the last failed login for users

Both commands accept a loginid as an argument. See the man pages.

The who command can also be used against /var/adm/wtmp. I like who -a /var/adm/wtmp. Again, see the man page.

Darrell

[Ahmed Hassan_1]

dear all;
I tried using last or who /var/adm/wtmp commands but both commands givig me only todays date so i am not aple to trace user from old date ;i tried using fwtmp command but it is still running from two houres ago ;so is there any way to spicify old dat?
ahmed

[Darrell Allen · Accepted solution]

Hi,

It appears your wtmp file has been truncated because you only see entries for "todays date". Do you have a cron job truncating wtmp?

If wtmp has been truncated then you will not be able to get the login info using last or who /var/adm/wtmp.

Concerning the long running fwtmp command: it reads from standard input so you would run it like:

/usr/sbin/acct/fwtmp < /var/adm/wtmp

Darrell

[harry d brown jr]

Look into turning on "accounting", which will log you user activity, but your system will experience some loss of performance.

Take a look at this thread:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x1cd9f715edc6d5118ff10090279cd0f9,00.html

live free or die
harry