Last Successful Login

[Spirit1]

When I use the Finger or Last command on the /var/adm/wtmp file, it does not show me the Year. I get the month and day and beginning and ending time.
I need to check out some logins to see when was the last time they were used.

 

[KenCunningham]

Spririt1 - how long has your box been up? As the entries for a last listing are in reverse chronological order, it shouldn't be too much of a problem to identify the year in question. I'm afraid I don't have a box which has been up long enough to see whether the older entries have, say, a 2005 appended if the entry doesn't refer to 2006.

I don't mind people who aren't what they seem. I just wish they'd make their mind up.

 

[motoslide]

Some shells create a .lastlogin in the users' $HOME directory. I use that often as a way to determine inactive user accounts.

For instance,
# cd /usr
# ls -lt */.lastlogin >userlist

Those which are in the current year will normally show the day and time, those over a year old will show the day and year. In any case, you should get a list where the active users are at the top, and the inactive users at the bottom.

"Proof that there is intelligent life in Oregon. Well, Life anyway.

 

[Annihilannic]

What OS exactly? Linux has the lastlog command, which gives the full date, I'm not sure if that's available on any other OS's.

Here's a script I wrote ages ago for Solaris that puts the year on the beginning of each line... it's pretty basic and assumes that you have frequent enough logins that there is always a login in December.

[tt]last | nawk '
BEGIN {y='`date +%Y`'}
$5 == "Dec" && last != "Dec" { y-- }
{ print y,$0 ; last = $5 }'[/tt]


Annihilannic.

 

[columb]

If you're using AIX then

lsuser -a time_last_login ALL

Admittedly this gives an output like

root time_last_login=1159187939

where the long number is seconds since 00:00 1st Jan 1970 but you can use perl to convert that. For example

#!/bin/perl -w
use strict;

foreach ( `lsuser -a time_last_login ALL` )
  {
  /^(\w+)\s+time_last_login=(\d+)/ and do
    {
    print "User $1 last logged in at ";
    print scalar localtime $2;
    print "\n";
    next;
    };
  chomp;
  print "$_ has never logged in\n";
  }

Ceci n'est pas une signature
Columb Healy

 

[Spirit1]

Thanks everyone.

I used the Finger command and got my information.