Users that have not login over time

[Darrell Tyler_1]

Hello,

Iâ m trying to script a way to sort out information of users that have not login in 120 days. The script route Iâ m venturing down has to do with using '/usr/lbin/getprpw -m slogint'. However, I know of no verbose value I can put with this command to weed out the "last successful login that is < 120 day".

Please help if yo

[RAC_1]

You can do last -R and then compare the last successful time. If it is more than 120 days, you can do whatever you want. A Clay has one great script calcj.sh. This script can give you different between two dates. You compare the difference and take further action.

Anil

[Darrell Tyler_1]

Excuse my ignorance but how would you put a 'last -R' into '/usr/lbin/getprpw -m slogint' ???

[RAC_1]

Getting last successful login.

On trusted systems -- From last -R "user_name" or getprpw. (This all apiles to the date when wtmp was started)

Now using calcj.sh compare the time difference, if more than what you want, take action what you want?

Hope this helps.

Anil

[Darrell Tyler_1]

ok I see how the last -R command is working from the the display below:


# last -R cartman
cartman pts/tl mugle Tue Mar 30 11:34 still logged i
cartman pts/tg 654.54.676.15 Fri Mar 26 14:27 - 17:09 (02:41)
cartman pts/tg 654.54.676.15 Fri Mar 26 09:51 - 14:19 (04:28)
cartman pts/te 654.54.676.15 Thu Mar 25 12:51 - 17:16 (04:25)

wtmp begins Thu Aug 7 07:56

However, I'm still not able to script to weed out users that have not successfully login withing a period of time.

[RAC_1]

In that case use lastb -R "user_name"

Anil

[Rodney Hills · Accepted solution]

Here is a perl script that reads the wtmp file directly (no need to use "last -R"). Determines the last login time for each user and displays the list of users who haven't logged in over 120 days.

HTH

-- Rod Hills

$template = "A8 A4 A12 l s s s s l a16 l";
$recordsize = length(pack($template,( )));
open(WTMP,"/var/adm/wtmp") or die "Unable to open wtmp:$!\n";
while (read(WTMP,$record,$recordsize)) {
($user,$ttyid,$tty,$pid,$type,$term,$exit,$time,$host,$hostip)=unpack($template,$record);
next unless $type == 7;
next unless $ttyid;
next if $ttyid eq "ftp";
next if $ttyid=~/\d+:\d+/;
$user=~y/\000//d; $ttyid=~y/\000//d; $tty=~y/\000//d; $host=~y/\000//d;
$hold{$user}=$time if $time >$hold{$user};
}
$over120=time()-120*24*60*60
foreach $user (keys %hold) {
if ($hold{$user} < $over120) { print $user,"\n"; }
}

[Rodney Hills]

Darryl,

I've notice many people have helped you with this problem and other problems you have submitted to the forum. But you have not assigned any points. It is common courtesy to assign points to the responses on how well the answer helped. This is beneficial to other people looking to answer similar questions/problems that you have posed.

-- Rod Hills

[Geoff Wild]

How about trying finger?

# finger gmc
Login name: gmc
In real life: Greg McKinnon
Directory: /home/gmc Shell: /bin/ksh
Last login Fri Mar 12 11:50 on ttyp3
No unread mail
No Plan.


You could even do something like:

touch /tmp/finger.last.logins
mv /tmp/finger.last.logins /tmp/finger.last.logins.bak
for i in `cat /etc/passwd | awk -F: '{print $1}'`
do
finger $i >> /tmp/finger.last.logins
done

Rgds...Geoff

[Darrell Tyler_1]

A huge amount of thank yous to everyone, Mr. Hillâ s perl script (with some minor tweaking for my system) did the trick. Iâ m extremely appreci