Dears,
My boss asked me to record the login information on AIX server, so I used "last" command to get i want. But it is so strange when i get a record the login date is Jan,01 1970 (as attached picture). does anyone know what happen?
Thanks and Regards,
That is just weird! Just wondering how long the system has been up!! 
uptime
I suggest to check more on that user: fstsfix it does not even have any info on terminal!
Hi bipinajith,
Thanks for your reply, here is info your wanted.
$ uptime
01:59PM up 64 days, 7:36, 8 users, load average: 2.23, 1.72, 1.72
BTW, i check the .sh_history of FSTSFIX and there is nothing weird in it.
cd .. #?1355908025#?
ls -l #?1355908026#?
ls #?1356050227#?
cd bin #?1356050233#?
ls #?1356050233#?
cd #?1356050237#?
fstsfix status #?1356050239#?
crontab -l #?1356050251#?
ls #?1356050316#?
cd log #?1356050318#?
ls #?1356050318#?
cd 4 #?1356050327#?
ls #?1356050328#?
cd #?1356050331#?
ls #?1356050332#?
cd bin #?1356050335#?
ls #?1356050335#?
...
And the crontab job works correctly. Please tell me if any infomation I can provide more, thks.
$ crontab -l
00 07 * * 1-5 /u/fstsfix/bin/fstsfix bod
#50 07 * * 1-5 /u/fstsfix/bin/fstsfix start
00 05 * * * /u/fstsfix/bin/fstsfix stop
40 05 * * * /u/fstsfix/bin/fstsrvd stop
45 05 * * * /u/fstsfix/bin/fstsfix eod
As per the AIX manual all previous logins and logoffs are recorded in the /var/adm/wtmp file. I'm not sure what exactly fstsfix is doing. So I won't be able to tell what is wrong. You have to analyze more on this executable to understand what is causing it to display this strange last login time-stamp.
Yes, like you said, I checked the wtmp by following cmd. And searched .sh_history which the last cmd executed by fstsfix in 2012/12/21 is "ls -l". I still can't figure out anything, maybe I should let it go.... XD
h56s1tst:/home/fstsfix># last fstsfix -f /var/adm/wtmp -n 10 console
fstsfix pts/7 10.81.XXX.43 Dec 24 10:26 - 14:33 (04:07)
fstsfix pts/6 10.81.XXX.43 Dec 24 09:50 still logged in.
fstsfix pts/4 10.81.XXX.43 Dec 22 08:20 - 17:34 (09:14)
fstsfix ftp 10.81.XXX.54 Dec 21 18:12 - 18:22 (00:09)
fstsfix Jan 01 08:00 - 08:55 (15695+00:55)
fstsfix ftp h5XXXtst Dec 19 18:10 - 18:11 (00:00)
fstsfix pts/6 10.81.XXX.54 Dec 19 17:01 - 19:19 (02:18)
fstsfix pts/6 10.81.XXX.54 Dec 19 16:51 - 16:58 (00:06)
fstsfix pts/7 10.81.XXX.54 Dec 17 09:40 - 11:52 (02:12)
fstsfix ftp 10.81.XXX.54 Dec 11 19:51 - 19:51 (00:00)
cd .. #?1355908025#?
ls -l #?1355908026#?
ls #?1356050227#?
You could always use lsuser for each user in turn (cut the first column from /etc/passwd) and extract the time_last_login value from that.
It is time in seconds since the epoch, so convert that to real time. If the value is zero (i.e. never logged on) you will generate the date/time 1/1/1970 00:00.
The conversion I use (that I found on here) is:-
perl -e 'print scalar localtime $ARGV[0],"\n" ' $1
I pass in the large number of seconds as a parameter, so if you call it realtime you get the following:-
RBATTE1> ./realtime 1234567890
Fri Feb 13 23:31:30 2009
RBATTE1>
I hope that this helps.
Robin
Liverpool/Blackburn
UK
Thank you, Robin. I tried the command "lsuser fstsfix", but it is too late that the time_last_login has been overwrote.
/># lsuser fstsfix
fstsfix id=414 pgrp=fsts groups=fsts,usms home=/u/fstsfix shell=/usr/bin/ksh login=true su=true rlogin=true
daemon=true admin=false sugroups=ALL admgroups= tpath=nosak ttys=ALL expires=0 auth1=SYSTEM auth2
=NONE umask=22 registry=files SYSTEM=( compat ) logintimes= loginretries=0 pwdwarntime=0 account_locked
=false minage=0 maxage=0 maxexpired=-1 minalpha=0 minother=0 mindiff=0 maxrepeats=0 minlen=0
histexpire=0 histsize=0 pwdchecks= dictionlist= fsize=2097151 cpu=-1 data=262144 stack=65536 core=2097151
rss=65536 nofiles=2000 time_last_login=1356316007 time_last_unsuccessful_login=1356398305
tty_last_login=/dev/pts/7 tty_last_unsuccessful_login=/dev/pts/4 host_last_login=10.81.XXX.43
host_last_unsuccessful_login=10.81.XXX.43 unsuccessful_login_count=1 roles=
BTW, about the perl converting the real time, it is awesome!! Because I converted it by EXCEL (X+8*3600)/86400+70*365+19 lately.
/># ./realtime 1356316007
Mon Dec 24 10:26:47 2012