Help with unix commands for user logins

Use and complete the template provided. The entire template must be completed. If you don't, your post may be deleted!

  1. The problem statement, all variables and given/known data:

List the last 3 times you logged into the hottub and the command(s) you used to obtain this information

  1. Relevant commands, code, scripts, algorithms:

  2. The attempts at a solution (include all code and scripts):
    1) last agreen1 |head -n 3
    2) tail -n 100 messages|grep agreen1

  3. Complete Name of School (University), City (State), Country, Name of Professor, and Course Number (Link to Course):

University of Illinois, O'Reilly School of Technology, Kelly Hoover, Linux/Unix 1: The Unix file system

Note: Without school/professor/course information, you will be banned if you post here! You must complete the entire template (not just parts of it).

So basically I telnet into a server called cold1 then ssh into a server called hottub, and then into one called bubble. I have root privilege in my bubble.

When i use the "last" command I was told that it only shows me where I have come from not where I am. If Im logged into the bubble it will show me my hottub logins. If Im on huttub it will show me my cold1 logins. So thats not the way.

So I logged into the hottub server and used cd /var/log to get to the log diectory. Then used the above command: tail -n 100 messages|grep agreen1.

This what my instructor said about my failed attempt: "You have the idea however we have a simpler command with a simpler output, that just shows logins and can specify only the last 3 logins.

Thanks for your help.
Al green

See the man page for last. The last command tells you about logins on the current host; look for options to limit the output both by number of lines and by user. Look at the man page for hostname as that will help you determine where you are.

Last does include information about where you logged in from, but I think that's not important for your assignment. Yes, you are on the right track I think.

Thank you for your help. Im not seeing anything in the last man page. I also was just looking at the tail man page. If I tail the file messages and pipe it through a search of my user name I get the info I need (at least it seems that way) but apparently there is an easier way or simpler command. I have reviewed my lesson several times and Im not seeing it. Ill messages her tomorrow if need be. I was trying for some help here because sometimes it starts a discussion and you can learn more from a group of people.

Thanks for your time.

Al

Seems to me the -n option to last would be helpful as well as the ability to sepecify the user name on the command line to limit what last presents. It is quite possible that in your environment the last command is different. What environment are you running (shell and o/s)?

Im using the bash shell and Im on a Linux os.

Two hints: Suppose you go to the car shop to buy some replacement part. If the dealer asks you which car it is you don't answer "a red one" or "a Ford". You tell him the exact model and the year it was built.

If you are asked about the OS you don't answer "Linux", but ideally the output of uname -a , eventually followed by the distribution and version. For instance:

Linux brecht 2.6.35-22-generic #33-Ubuntu SMP Sun Sep 19 20:32:27 UTC 2010 x86_64 GNU/Linux

This tells the kernel version (2.6.35-22), that it is a 64-bit system (x86_64) and the distribution (Ubuntu), from the kernel version one can deduce that it is Ubuntu 10.04.

The second hint: are you sure you read the right man page? Maybe man pages are not installed (install them) or are not installed properly? Are they indexed correctly? (I am not sure if this is necessary in Linux - in AIX after installing man pages root is supposed to issue catman -w .)

Just to make sure we talk about the same: this is the page you should see:

# man last
LAST,LASTB(1)                  Linux System Administrator's Manual                  LAST,LASTB(1)

NAME
       last, lastb - show listing of last logged in users

SYNOPSIS
       last  [-R]  [-num]  [  -n  num  ]  [-adFiox]  [  -f file ] [ -t YYYYMMDDHHMMSS ] [name...]
       [tty...]
       lastb [-R] [-num] [ -n num ] [ -f file ] [-adFiox] [name...]  [tty...]

DESCRIPTION
       Last searches back through the file /var/log/wtmp (or the file designated by the -f  flag)
       and  displays  a list of all users logged in (and out) since that file was created.  Names
       of users and tty's can be given, in which case last will show only those entries  matching
       the arguments.  Names of ttys can be abbreviated, thus last 0 is the same as last tty0.

       When last catches a SIGINT signal (generated by the interrupt key, usually control-C) or a
       SIGQUIT signal (generated by the quit key, usually control-\), last will show how  far  it
       has searched through the file; in the case of the SIGINT signal last will then terminate.

       The  pseudo  user  reboot logs in each time the system is rebooted.  Thus last reboot will
       show a log of all reboots since the log file was created.

       Lastb is the  same  as  last,  except  that  by  default  it  shows  a  log  of  the  file
       /var/log/btmp, which contains all the bad login attempts.

OPTIONS
       -f file
              Tells last to use a specific file instead of /var/log/wtmp.

       -num   This is a count telling last how many lines to show.

       -n num The same.

       -t YYYYMMDDHHMMSS
              Display  the  state  of  logins as of the specified time.  This is useful, e.g., to
              determine easily who was logged in at a particular time -- specify that  time  with
              -t and look for "still logged in".

       -R     Suppresses the display of the hostname field.

       -a     Display the hostname in the last column. Useful in combination with the next flag.

       -d     For  non-local  logins,  Linux stores not only the host name of the remote host but
              its IP number as well. This option translates the IP number back into a hostname.

       -F     Print full login and logout times and dates.

       -i     This option is like -d in that it displays the IP number of the remote host, but it
              displays the IP number in numbers-and-dots notation.
       -o     Read an old-type wtmp file (written by linux-libc5 applications).

       -x     Display the system shutdown entries and run level changes.

NOTES
       The  files  wtmp  and  btmp  might not be found. The system only logs information in these
       files if they are present. This is a local configuration issue. If you want the  files  to
       be  used,  they  can  be  created  with  a  simple  touch(1)  command  (for example, touch
       /var/log/wtmp).

FILES
       /var/log/wtmp
       /var/log/btmp

AUTHOR
       Miquel van Smoorenburg, miquels@cistron.nl

SEE ALSO
       shutdown(8), login(1), init(8)

                                           Jul 31, 2004                             LAST,LASTB(1)

I hope this helps.

bakunin

Sorry about that. I almost did post it. These are the os in the order I login to them.

Linux cold1.useractive.com 2.6.32-220.13.1.el6.x86_64 #1 SMP Tue Apr 17 23:56:34 BST 2012 x86_64 x86_64 x86_64 GNU/Linux

Linux hottub3.useractive.com 2.4.34.2-skas3 #7 SMP Fri Mar 21 14:53:59 CDT 2008 i686 i686 i386 GNU/Linux

Linux bubble151.private.useractive.com 2.4.32-bs3 #1 Thu Jun 1 13:41:53 CDT 2006 i686 unknown

---------- Post updated at 06:17 AM ---------- Previous update was at 06:09 AM ----------

This is the man page I have in my hottub and bubble. I have the man page you posted above in the first server, cold1.

                                                                                                                        
LAST,LASTB(1)  Linux System Administrator's Manual  LAST,LASTB(1)                                                       
                                                                                                                        
NAME                                                                                                                    
       last, lastb - show listing of last logged in users                                                               
                                                                                                                        
SYNOPSIS                                                                                                                
       last [-R] [-num] [ -n num ] [-adiox] [ -f file ] [name...]  [tty...]                                             
       lastb [-R] [-num] [ -n num ] [ -f file ] [-adiox] [name...]  [tty...]                                            
                                                                                                                        
DESCRIPTION                                                                                                             
       Last  searches  back  through the file /var/log/wtmp (or the file designated by the -f flag) and dis             
       plays a list of all users logged in (and out) since that file was created.  Names of users and  tty's            
       can  be given, in which case last will show only those entries matching the arguments.  Names of ttys            
       can be abbreviated, thus last 0 is the same as last tty0.                                                        
                                                                                                                        
       When last catches a SIGINT signal (generated by the interrupt key, usually control-C)  or  a  SIGQUIT            
       signal (generated by the quit key, usually control-\), last will show how far it has searched through            
       the file; in the case of the SIGINT signal last will then terminate.                                                   
       
      The pseudo user reboot logs in each time the system is rebooted.  Thus last reboot will show a log of            
       all reboots since the log file was created.                                                                      
                                                                                                                        
       Lastb  is  the  same  as last, except that by default it shows a log of the file /var/log/btmp, which            
       contains all the bad login attempts.                                                                             
                                                                                                                        
OPTIONS                                                                                                                 
       -num   This is a count telling last how many lines to show.                                                      
                                                                                                                        
       -n num The same.                                                                                                 
                                                                                                                        
       -R     Suppresses the display of the hostname field.                                                             
                                                                                                                        
       -a     Display the hostname in the last column. Useful in combination with the next flag.                        
                                                                                                                        
       -d     For non-local logins, Linux stores not only the host name of the remote host but its IP number            
              as well. This option translates the IP number back into a hostname.                                       
                                                                                                                        
       -i     This  option  is like -d in that it displays the IP number of the remote host, but it displays            
              the IP number in numbers-and-dots notation.                                                               
                                                                                                                        
       -o     Read an old-type wtmp file (written by linux-libc5 applications).                                         
                                                                                                                        
       -x     Display the system shutdown entries and run level changes.

NOTES
       The files wtmp and btmp might not be found. The system only logs information in these files  if  they
       are  present. This is a local configuration issue. If you want the files to be used, they can be cre
       ated with a simple touch(1) command (for example, touch /var/log/wtmp).

FILES
       /var/log/wtmp
       /var/log/btmp

AUTHOR
       Miquel van Smoorenburg, miquels@cistron.nl

SEE ALSO
       shutdown(8), login(1), init(8)

                           Jul 29, 1999                         1

(END) 
 
      

No problem.

Then read again. agama even mentioned the option you might find interesting.

I hope this helps.

bakunin

Yeah I get that I think.

bubble151:~$ last -n 3 agreen1
agreen1  pts/0        hottub.private.u Mon May  7 07:51   still logged in   
agreen1  pts/0        hottub.private.u Mon May  7 05:04 - 05:14  (00:09)    
agreen1  pts/0        hottub.private.u Sun May  6 21:22 - 22:12  (00:49)    

or
bubble151:~$ last -n 3 -R agreen1
agreen1  pts/0        Mon May  7 07:51   still logged in   
agreen1  pts/0        Mon May  7 05:04 - 05:14  (00:09)    
agreen1  pts/0        Sun May  6 21:22 - 22:12  (00:49) 

The problem Im having is that Im being told basically that I need to logged in to the hottub server and run whatever command and see my logins from there.

The above code is from when I logged in on my bubble and shows my activity on the hottub. The info in the above code should be what i need (informationally). Im going to email her in a bit.

Well I did learn that I don't have to pipe last like i did in my first post.:slight_smile:

I still feel like this.:wall: At least now I have a few questions I can ask my instructor.

Thank you. I appreciate the help from both of you.

correct. If you include "-R" is merely a matter of taste, but you got the drift.

Then issue the command there, simply. If you read the man page careful enough you will notice the following:

There is a file called /var/tmp/wtmp , where every login/log�ut-activity is stored. This file has a certain format and last is designed to retrieve information from this file and put it in readable form. You can even create a file of this certain format yourself and let "last" work on that (with the "-f" option). As every system maintains this log you can query it on every system.

NO!!!

It shows, that you have logged in to bubble coming from hottub. You logged in to hottub, then logged in to bubble from there. For the bubble system, you are coming from hottub, while for the hottub system you are coming from whichever system to used to access it.

Think of it as a series of rooms (the systems) connected by doors (the network connections). Every room "knows" which door you came through when you entered it, but not more: if you start in room A, go to room B and from there to room C, room C will record "has come from room B", room B will record "has come from room A" and room A will - well, it will know you started there, because you came from nowhere else.

The equivalent of "knowing you started there" is having some local terminal instead of a network address as "coming from". Compare your output (network connection) to when i use "last" on the laptop i am writing this. Notice the "pts" and "tty" devices instead of a network address. These are local (pseudo)-terminals instead of network connections.:

# last
bakunin  pts/0        :0.0             Mon May  7 17:25   still logged in   
bakunin  pts/0        :0.0             Mon May  7 06:50 - 07:02  (00:12)    
bakunin  pts/0        :0.0             Mon May  7 06:42 - 06:43  (00:00)    
bakunin  tty7         :0               Sat May  5 20:21   still logged in   
reboot   system boot  2.6.35-22-generi Sat May  5 20:21 - 17:25 (1+21:04)   

Don't give up. Once you managed some basic understanding you are in for one of the most wonderful experiences in life. Working with Unix is like playing an instrument - the better you get the more beauty you reveal and the more things you find that you can still learn while the topic gots even more interesting with every answered question.

I hope this helps.

bakunin

Everything you have posted has helped. I cant thank you enough. It has been frustrating me because of a misunderstanding in a few things my instructor said to me in emails. I thought she was saying that my first try using last was wrong and my second try using tail was on the right track. but thats not what she meant. We exchanged emails today.

I love this class Im taking. This one question is the difference between 96% done and 100% done my class and can move on to the next one. ha ha It figures right?
I am much more comfortable erecting steel building that typing terminal commands!:smiley:
I do love learning. I'll be going back to review and read more man pages. Ill update this when I figure it out.

Thanks again

Sorry it took so long to post. Its was just as you stated in the post above. I had been looking for the output to say you have entered room B at such and such a time. But instead its like saying you already know where you are. It tells you when you got there and from where.

Thanks again

Hi

you can try last -an | head
last just read /var/adm/wtmpx file.