track logins

[Tony500]

Does anyone know if HPUX 11.* tracks logins and logouts in a file somewhere?
Thanks

[Rodney Hills]

Do a man on the "last" command.

-- Rod Hills

[Tony500]

I'm looking more for a way to check a specific time range and see if anyone logged on. Is there a log file I can use for that?

[Jeff Schussele]

Hi Tony,

Yes in

/etc/utmp -> All users logged in
/var/adm/btmp -> unsuccessful logins
/var/adm/wtmp -> Record of all logins - good & bad

Rgds,
Jeff

[Jeff Schussele]

Hi,

Sorry, I'm a dummy....

/var/adm/wtmp -> Record of all logins & logouts.

Jeff

[Tony500]

I need a way to check a specific time range on a specific day and see if anyone logged on.

[Rodney Hills]

The information is in utmp. It is up to you to develop a program or script to select and present it the way you want.

-- Rod Hills

[Tony500]

If I try to more the file, /var/adm/wtmp , its a jumbled mess. Whats the best way to use this file to check a specific time range on a specific day and see if anyone logged on?

[Jeff Schussele]

Hi (again) Tony,

Use the /usr/sbin/acct/fwtmp command to write a text file from the binary.
Then you can look it over.

HTH,
Jeff

[Steve Labar]

last is the command that reads the wtmp file. And lastb is the command that reads the btmp file. As Rodney pointed out, you will need to write your own utility to format the information as you need it.

Good Luck.

Steve

[Rodney Hills]

I would pipe the output from "last" into a perl script that would parse the information and setup memory tables that would map day/time snapshots to users logged in.

If you don't know perl, then you could develop whatever programming/scripting language you are comfortable with.

-- Rod Hills

[Deshpande Prashant]

HI
Try using fwtmp command.

Check following thread.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x16268f960573d611abdb0090277a778c,00.html

thanks.
Prashant.

[Darren Prior]

Hi Tony,

If manipulating the output of last doesn't give you what you're looking for then you may need to write a program that can read the wtmp file. As you've found it's a binary file - the utmp(4) man page gives the file structure.

Alternatively, if you need to have this functionality in the future you could consider using auditing on the login event. You will need to trust your system for this - there's many threads on trusting/auditing.

regards,

Darren.