Linux

Ask something
Discussion Locked

User account login question

0 helpful
5 replies

by scifiman 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Running Red Hat 7.2. Is there an alternative to using the "last" command? A consultant is claiming billable hours on 5/27 and I need to see if he had at least logged onto the box that day. I tried the command "last" but the .../wtmp file only goes back a week (probably wiped by a cron job) and this particular server was reloaded with RH about a month ago and hasn't been set up per policy yet. I am not as familiar with Linux, is there some other command(s) I can try that might show account activity that I need to find? Thanks!

Regards,
David

5 replies

by les

check the home directory of the user. Look for file modification times. But especially look at the .bash_history file and if there .lastlogin. These hidden files appear in all user directories and might help you out here. Other than that i am prettysure that login's and logut's get logged into /var/log/***** (probably messages). On the other hand if the user had checked email at that it then email logins and logouts get logged to wherever your mail server logs are.

by servermonkey

If he is logging in via ssh, check "secure" logs. Also, I would restore the wtmp and messages logs from backup on that day and check it. Instead of looking for modified time, you can also check access time (atime check the man pages for find) and that will give you the last time the files were accessed.

HTH

Jeff
As for the future. . .

You could run a daily cron job that dumps the contents of the wtmp file into another file and archive it, or mail it to you. You could also add a tiny script in /etc/profile that checks for logname, and if it is the consultant write that to another file of your chosing. Or -- Use cron to check every min, 5 mins, etc using the who command and grep for consultants login and write that to a file.

This discussion is closed to new replies.