Report with user login/logout information!

[MAD_2]

My boss has requested I provide him with a report that will show him anyone that has logged in/out of the system on a daily basis. He is interested on getting this report to him in the best possible format with information about every single session.

So far he did not specify if he reqires any more details other than login/logout information. Can some of you provide some suggestions to provide him with this information, what is the best way to extract it, and what tools if any can be used. Also, if more details will be required later on, can you forewarn me about what may need to be setup (I know accounting will be a requirement to collect specific event information, but in order to do that we have to convert the system into trusted mode).

Thanks for any suggestions!

System specs: RP5470 with HP-UX 11.0 including Glance Plus and HP-Openview MeasureWare Agent (for this system, but there will also be another system for which he has requested the same information that I don't think has these tools).

[Uday_S_Ankolekar]

Just type last command redirect the output to a file.

last >/tmp/somefile

-USA..

[James R. Ferguson · Accepted solution]

Hi:

THe simplest report can be generated with 'last' for good logins; 'lastb' for failed ones. See the man pages for 'last' for more information.

If '/var/adm/wtmp' (for 'last') or '/var/adm/btmp' for 'lastb') don't exist, simply 'touch' them to create them. The absence of the files turns off the reporting.

Keep the permissions of /var/adm/btmp readable only by root. It is a security risk to allow anyone to read it.

Regards!

...JRF...

[Sridhar Bhaskarla]

Hi,

last -R will give you information about successful logins including the where they logged in from. lastb -R is the corresponding command for unsuccessful attempts.

You may want to write a script and put it in cron and mail it to you and yourboss to make it automated. You will have to deal with manipulating the dates though. Search this site and you may find couple of scripts.

-Sri

[Chris Wong]

Sounds like you could use accounting. This doesn't have a high overhead (like auditing). Edit the /etc/rc.config.d/acct file and change START_ACCT=1.
Next, start it: /sbin/init.d/acct start
(I suggest adding a umask statement to the /usr/sbin/acct/startup script before starting this).
Accounting can generate daily reports, which I think is what your boss will want. (It will show just one entry for each user with their last login date). You can also look at the command issued by each user. Look at the man pages for acct and acctcom.

- Chris