Incoherence between finger and .sh_history

UNIX for Advanced & Expert Users
1

Hello,
I've a script that verifies users connections.
This is the check part

do
NEVER=$(finger $USER | grep -i Never)
 if [ "$NEVER" != "" ]
 then
    NAME=$(finger $USER | grep -i "In real life" | sed -e 's/^.*life: //')
    echo $USER $NAME >> never_logged #" "$NEVER
 fi
done

that for a specific user says me that he never connected on last 4 months :

wtmp begins Wed Jul  x xx:xx

and, as you can see, it seems to be correct :

SERVER$ finger user
Login name: user                     In real life: Name Surname
Directory: $USERHOME       Shell: /bin/ksh
Never logged in.
No unread mail
No Plan.

Well, the problem is that I know "user" is almost daily connected, as you can easily see from is .sh_history.

SERVER$ ls -la $USERHOME/.sh_history
-rw-------   1 user  groupe     111111 Nov 26 10:02

This is a diffuse problem. Anyone has suggestions?
Best Regards

2

Do you KNOW (first hand knowledge from obervation with truss/trace/opensource) what finger does - what files it reads - on your box?

What OS do you have?

My first guess is that there is a disconnect between finger's actual implementation and what you think it does.

3

Finger reads "wtmp". If wtmp does not exist, or is empty, or has wrong permissions, finger will return "Never logged in".

What does this give?

last -R username
4

@jim mcnamara
I supposed the same... but I don't find any trace :-/

munmap(0xEF750000, 8192)                        = 0
open("/etc/passwd", O_RDONLY)                   = 3
open("/var/adm/lastlog", O_RDONLY)              = 4
open("/var/adm/utmpx", O_RDWR|O_CREAT, 0644)    Err#13 EACCES
open("/var/adm/utmpx", O_RDONLY)                = 6
open("/var/adm/utmpx", O_RDONLY)                = 7
access("/var/adm/utmp", 0)

SunOs 5.6

---
@methyl
no -R option for last

-rw-r--r--   1 root     group  33654 Nov 30 09:54 wtmp
-rw-r--r--   1 root     group  894587 Nov 30 09:54 wtmpx

/here/i/am% last $USER

wtmp begins Wed Jul  x xx:xx
5

methyl - I have not seen a POSIX specification for finger stating that it reads any given file. However, it does read other accounting files. See above. On Solaris, finger reads /var/adm/utmpx. Read the man page.

Gogol - It looks like wtmp is being updated. last should work as methyl indicated but without the -R. There are also wtmpx entries on your system. wtmp is written to only if the file exists, and for you is not part of the picture for finger.
what does

ls -l /var/adm/utmp

show?

if you grep for your username in umtpx what do you get? -- if it works you will see a lot of garbage characters. If they trash the screen use the reset command.

6

finger is ready to try to match stuff in the gecos field and it marches to its own beat with respect to user names. You have concealed the user's real name and that is probably what is wrong. Is the is user name a mix of 8 characters or less of all lower case letters or digits?

7

Looked more closely at the original post. Could multiple matches with text in the password file.

Preferable syntax makes an exact match on the username.