Log in history 5

[remsauk]

Hi...

Is there an AIX command or something in smit that will tell me when a user last logged on? I come from an AS/400 background and there's a command wrkusrprf (work user profile)that I can use...ie wrkusrprf js* <Enter> would give me all users w/js...like John Smith. I can take option 5 to display the user's profile and one of the values is Last Log in....I know there are history logs in AIX but I'd rather have to search thru that.

Thanks

 

[miteshdmanek]

If you look in the /etc/security directory you will see a few files related to logins. lastlog is the one you want for users' last log in times.

 

[RodKnowlton]

lsuser -a time_last_login <user>

You can convert it from seconds since epoch (00:00:00 January 1, 1970 UTC) to a date in perl with:

perl -e 'print scalar localtime(TIME), "\n"'

where you substitute the seconds since epoch for TIME.

Here's a C program to do the same, accepting the time in seconds as its only argument:

#include <stdio.h>
#include <sys/time.h>

main(int argc, char **argv)
    {
    long seconds;
    ++argv;
    seconds = atol(*argv);
    printf("%s", ctime(&seconds));
    }

Rod Knowlton
IBM Certified Advanced Technical Expert pSeries and AIX 5L

 

[remsauk]

Hi...

Thanks to both of you...I'll out your suggestions to use...

 

[trifo]

And what about "last" command?

[tt]
n65:/# last | grep trifo | head
trifo pts/1 171.19.9.162 Jul 08 11:38 still logged in.
trifo pts/1 171.19.9.162 Jun 30 15:43 - 17:52 (02:09)
trifo pts/1 171.19.9.162 Jun 30 09:09 - 09:37 (00:28)
trifo pts/1 171.19.9.162 Jun 24 16:40 - 16:59 (00:19)
[/tt]

It is a standard Unix tool to log user login/logout activity.

--Trifo

 

[BFOJ]

who /var/adm/wtmp | grep remsauk

 

[RodKnowlton]

trifo,

Thanks for bringing that up. I've been working with time_last_login for my own purposes lately, so it's what first came to mind.

remsauk,

"last" will work in many situations, but some admins like to keep their wtmp at a reasonable size and trim it regularly.

If wtmp is never trimmed, or you're sure the user has had activity more recently than the earliest date kept in wtmp ("last | tail" will tell you that date), then use "last <user> | head". For older inactive users, or if you need the date in a more script friendly form, use the method I described earlier.



Rod Knowlton
IBM Certified Advanced Technical Expert pSeries and AIX 5L

 

[remsauk]

Thanks to all of you...this has proved very helpful...I'm rather new to aix...I'm also one of those who doesn't trim wtmp.

Thanks again

 

[trifo]

remsauk: be careful when trimming wtmp. Well, the simple method is to truncate it to zero

cat /dev/null > /var/adm/wtmp

Maybe it is a good idea to archive the contents of the file. gzip can effectively shrink it.

Also there is a tool for truncate the wtmp to keep a specific amount of entries. I have found the solution in this forum.

--Trifo

 

[KenCunningham]

And this is (possibly) it:

http://www-1.ibm.com/support/docvie...g1pTechnote0575&loc=en_US&cs=utf-8&lang=en+en

Sorry if this appears garbled - the link seems to work though!

 

[RodKnowlton]

If you want to automatically trim to a certain number of days, as opposed to entries, you'll need a program (perl can do it), and the record format is the same as "struct utmp" in /usr/include/utmp.h.

If you do this, be sure to always check the OS version before doing anything. The format can and does change from version to version, which is why I won't be posting my script.


Rod Knowlton
IBM Certified Advanced Technical Expert pSeries and AIX 5L

 

[trifo]

Hey, we escalated the topic rather deeply...

There is a script to trim the wtmp file keeping a specific number of entries:

#############################################
[tt]

# keep this many entries of wtmp
TRIMLINES=200

WTMPFILE=/var/adm/wtmp
TMPFILE=/tmp/tempwtmp

# create temporary text based database
cat $WTMPFILE | /usr/sbin/acct/fwtmp | head -$TRIMLINES > $TMPFILE

# reload entries from tmp text to wtmp
cat $TMPFILE | /usr/sbin/acct/fwtmp -ic > $WTMPFILE

# discard obsolete temporary data
rm $TMPFILE

[/tt]
########################################

--Trifo