Tracking user login

[bhoang]

Is there a command that I can use to check if a user has login at a certain date?

[James R. Ferguson]

Hi:

Yes, use 'last' (see 'man last'). If /var/adm/wtmp is present, then this file will contain a record of all logins. Do this:

# last

If /var/adm/wtmp isn't present, then you will need to first touch it to start collecting this information. Permissions should be 644 owned by root. Trim (or create) the file by redirecting /dev/null into it:

# /dev/null > /var/adm/wtmp

Bad login attempts are (corresponding) kept in /var/adm/btmp and are interrogated with 'lastb' [see same man as above].

...JRF...

[Jitendra_1]

"last" will show you all the details of users logged in and logged out.

[bhoang]

Hi all,
I did use the Last command but it only shows me
the last two days. What command can I use to see if the user has login on, say the first of
the month.
TIA

[James R. Ferguson]

Hi:

The file grows without bounds and is usually trimmed (dev/null > /var/adm/wtmp). In this case, the data you seek is gone.

...JRF...

[Josee Bourget-Thuma]

Hi Bach,

You will also find records of ftp login as well as records of those who "su" and which account they "su" to in /var/adm/syslog/syslog.log.

Take care,
Josee

[Philip Chan_1]

Hi Bach,

Besides the "last" command there is another option you could try,

1. Via SAM convert your system to "trusted" mode
2. Go into SAM -> auditing and security -> audited event
3. Make sure auditing is turned on, and the login event type should include both "success" and "failure" events

After all you can view the good and bad login attempts via the "view audit log" option.

Don't know why on your system the "last" command losted its historical data. It is the simplest way to achieve what you want so use this one if possible.

Rgds,
Philip

[Shannon Petry]

One of the best tools, and least used tools is the berkely accounting package.

Read up on the man pages for runacct, pacct, and their references.

I use accounting on ALL seats. I get a monthly report on all users, each time they have logged in, for how long, what applications they ran, etc...

It's built in and free, as well as supported by HP-UX, SunOS, AIX, Irix, SCO/Unix and Linux. It gives you tons of information, most of which you wont need, but some that you do need is priceless!

Regards,
Shannon

[Don Bentz]

If the information prior to the last 2 days is important, you could restore /var/adm/wtmp to another file and use the '-f' option to the 'last' command to specify the 'old' data's collection file. BE SURE YOU DON'T restore over the top of you active file (/var/adm/wtmp).