user log in and out time

[Jeff Hagstrom]

Is there anyway to figure out when someone logged in and logged out of unix?
RP7410 HPUX 11.i

[Richard Beyko_1]

try the 'last' command

[Mel Burslan]

last | more

should show you this information

for failed login attempts, you can check

lastb | more

Hope this helps

[James R. Ferguson]

Hi Jeff:

As noted, 'last' and 'lastb' for good and for bad logins.

You need to first create these accounting files. Their absence turns off the logging.

# touch /var/adm/wtmp #...to enable 'last' logging

# touch /var/adm/btmp #...to enable 'lastb' logging of bad logins

Make sure that '/var/adm/btmp' is owned by root and readable ONLY by root. To allow non-root users to read this file may expose passwords used with login attempts.

Regards!

...JRF...

[Jeff Hagstrom]

I should have been more clear. Last and lastb both tell some info. We have a person that says they work over the weekend. I can see when they logged in, but I can't see when the logged out.

[Mel Burslan]

Jeff, unfortunately, if the users stays logged in or ends his/her session abruptly, i.e., not with a ctrl-D or exit command, last will not catch that and will show the user logged in until the end of the time (i.e. system reboot) and there is no workaround for this I know of.

One thing comes to mind that you can check the validity of this user's last activity, and it is only available if he/she did not login since then, is to check the modification time of the .sh_history file if it is utilized.

another method that comes to mind is a little more convoluted. Find the time logged in, find the associated telnetd/sshd process id spawned from the syslog and find the same PID getting killed/terminated again in the syslog.

But neither of the two methods are bulletproof. It is basically a crapshoot if you can find something.

HTH

[Jeff Hagstrom]

The history file tells me when they logged in, but not when they logged out. Someone mentioned the btmp and wtmp files, I have those already created. How do I look at them? They aren't legiable, or least not enough to tell me when someone is logging in our out.

[Jeff_Traigle]

last reads wtmp.
lastb reads btmp.

You can't look at them directly.

[DCE]

If your system is trusted, you can use the auditing subsystem to track an individual user. the following link tells more....
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=749837.

More links are available by performing an itrc search for audit user.........

[Mohanasundaram_1]

You are a good candidate for using "auditing"