using last to show user login/logout

[kirk_11]

I need to audit user login and logout actions. I want to use the last command to get this information but it does NOT seem to catch login/logout actions from the local terminal - it only seems to be catching telnet login/logouts. Does anyone know how to show all login/logout actions?

[Pete Randall]

Kirk,

Have you tried "last console"?


Pete

[kirk_11]

no I haven't. I would like to get all of the login/logout info - console and telnet

[Javier Ortiz Guajardo]

take a look at # man wtmp

These files, which hold user and accounting information for such
commands as last, who, write, and login

regards

[Geoff Wild]

Strange - last works on my servers (11.0 and 11.i)....what OS version are you running?

gwild ttyq0 Mon Jul 7 14:22 - 14:58 (00:36)
root console Wed Jul 2 11:33 - 11:40 (00:06)

[kirk_11]

Thanks for all of the replies already!

The os that I am running is 10.20

[Pete Randall]

Kirk,

I'm also on 11.x servers. There seems to be some difference in 10.20 - try "last console" just out of curiosity and see what it says.


Pete

[John Meissner · Accepted solution]

last -R | sort will give you a good list... also I have a useful script which is attached

[Geoff Wild]

Maybe you can make use of .sh_history and logout....

If the user is cshell, then create a .logout - insert comands you want to run - like:

echo `who am i ` " logout on " `date` >>.logout_history

If not cshell, then you could fake it like this:

1. In your .profile file, add the line :

trap ' .$HOME/.sh_logout; exit 0
(Some systems may need $LOGDIR instead of $HOME.)


2. Make a file in your home directory named .sh_logout. Put
in the commands you want to be run when you log out. For example:

clear
echo `who am i ` " logout on " `date` >>.logout_history

The trap will read the .sh_logout file when the shell exits.

Something like the above may work, maybe add a ps /who -u to see what the tty is...

Rgds...Geoff

[kirk_11]

I will be checking these and let you all know what happens.

[kirk_11]

for those of you who helped me - thanks! The system had a bad real time clock module. I replaced it and magically, the last command seems to behave as expected. I don't quite understand... Anyway, things seem to work...

[Caesar_3]

Hello!

Use last: last
you will get info for the user
also you can grep wanted data.

Caesar