List of Users who login the server

[Junghun]

Hi
I have some quetions about the list of users who logged in the server.
1.The var/adm/utmp file record the user who still logged in the server,and the "w" is also display the user who logged in the server.But the Two is not all the same.Some of the users in the utmp list is already loggded out.why this happen?
2.Sometimes the "w" command displays the user who have already logged out long time ago.why this happen?
3.sometimes the list that "w" command displays does not cotain the ip who logged in the server.why this happen?
4.The auth.log in the syslog is record the times when the root user logged in the server,is that right?Then why the list of auth.log and wtmp log do not match?
Thanks
Junghun

[Venkatesh BL]

What is the OS & patch version?

[Junghun]

OS:Tru 64 V5.1.B
Oracle:8.1.7.4

Patches installed on the system came from following software kits:------------------------------------------------------------------

- T64KIT0024519-V51BB25-E-20041218 OSF540
- T64V51BB24AS0003-20030929 OSF540
- T64V51BB25AS0004-20040616 OSF540
- T64V51BB25AS0004-20040616 TCR540

Thanks
--Junghun

[Ivan Ferreira]

1- I think that the file that you should use /var/adm/wtmp (The login/logout database file )

2- I think that the system did not record the logout because the user disconnected the session without exit/logout.

3- Maybe somebody su to that user?

4- You should disable root access, allowing only the use of certain users in the group system to su to root.