Re: Check when a user last logged in?

Bill Campbell typed (on Fri, Aug 08, 2008 at 02:07:34PM -0700):
| On Fri, Aug 08, 2008, Jeff Hyman wrote:
| >Jean-Pierre Radley typed (on Fri, Aug 08, 2008 at 04:22:26PM -0400):
| >| Jeff Hyman typed (on Fri, Aug 08, 2008 at 10:11:49AM -0400):
| >| | Assasin.x@xxxxxxxxx typed (on Thu, Aug 07, 2008 at 04:18:40PM -0700):
| >| | | I'm trying to make a script that will remove/point out or delete old
| >| | | user accounts. The problem is, I have no idea how to check when a
| >| | | user last logged in!
| >| | |
| >| | | Checking the modification date of the home folder will not work
| >| | | because there are many users that use the same home folder. I had
| >| | | heard SCO has some sort of built in way of checking for this, or that
| >| | | there is a unix command that can do it.
| >| | |
| >| | | Anybody out there able to help me out?
| >| | |
| >| | | Thanks in advance!
| >| |
| >| |
| >| | # last user_name | head -2
| >| | ... or ...
| >| | # last user_name | head -2 | tail -1
| >|
| >| Since the original poster is looking for "old user accounts", the 'last'
| >| command is useless, because it will only provide login data for the
| >| last one to seven days -- unless one has changed root's crontab to run
| >| /etc/cleanup at some time other than early Sunday morining.
| >
| >Hello JP,
| >
| >Interesting.... looks like I turned that OFF.
| >I personally like being able to use 'last' and go back in history.
| >Things do pop up from time-to-time especially around payroll
| >conflicts.... but thanks for the input.
|
| If I were doing this, I would put something in the system
| /etc/profile that added a record to a database of some kind,
| postgresql, mysql, or a simple hash (bdb, gdbm, etc.) containing
| the username, time, tty, and IP address if available. Then it
| would be easy to simply select on usrname, max(logintime) to see
| the last time somebody logged in.
|
| Going a step further, an appropriate ``trap'' statement that
| would add a record on logout could give more information.
|
| Bill

Learning alot on this one. Do 'last' and '/etc/profile'
have limitations ? Specifically where do they "not" record
a login event ? I kinda know the answer, but not all the
answer. csh, ftp ? If not, where do they keep a "log"
of events ?

- Jeff H



.