User logout status

[Piyush S]

Hi All

Is there any way to find whether user has logged out or was killed.

Actually I want to find out whether a user logged out using command or thru CDE Exit button or was forcefully killed by root

Regds
Piyush

[Steven E. Protter]

Shalom,

If you have a time, you can check /var/adm/syslog.log

If it was a system problem you will know there.

You can check the root keyboard log which defaults to ~/.sh_history

The lack of a cleanup on a kill might leave the user left on the last command display as logged in.

SEP

[Dave Hutton]

Do you want to know for the future?
I noticed in their home directory theres a .dt directory with some logs.

startlog shows starting, but it doesn't show anything about them logging out.

There is another directory called sessionlogs and in there theres the logs on sessions. By default it doesn't log, but it looks like if you want to know in the future, you can turn logging on.

servera:root /home/username/.dt/sessionlogs # cat servera_DISPLAY=XXX.XXX.XXX.XXX:0
This session log file is currently disabled.
To enable logging, edit /home/username/.dtprofile and
remove dtstart_sessionlogfile=/dev/null line.

You could enable logging and maybe it would tell.

But if you are going against something that had happened it doesn't look like much is logged. You could check the files under .dt and check the ones mentioned above.

[Marco A.]

This other one was a very good forum.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=912830&admit=-682735245+1178728578570+28353475

Hope that helps...

Marco

[Piyush S]

Thanks All For Your Replies....

What I actually wanted to know is to find why did a user logged out when he was trying to unlock the screen, after being away from the W/S for some hrs.

I did check in the syslog file but was unable to trace anything. Also there is no TMOUT value set ( its 0 ).

Piyush