hi,
does anyone knows how to trace a user session on a unix system:
i want to log these things
1- login
2- date of starting session
3- date of closing session
i've tryed who and last but they don't give closing time of session
regards
hmaiida
last is the command you require....
For me (SuSE 8.2 here - HP-UX 10.20 as far as I remember - i'm not at work at the moment so can't check) it shows amongst other things username, session start (date+time), session close (time only), plus duration.
Edit: Just to illustrate - sample output from "last" on HP-UX 10.20 (now that I'm at work!)
auser ttyq8 Thu Nov 25 10:38 - 21:48 (11:09)
buser ttyq0 Thu Nov 25 09:31 still logged in
cuser ttyq8 Wed Nov 24 10:15 - 17:09 (06:54)
.
.
.
Cheers
ZB
You can read about the auditing options that exist under HPUX in this document at docs.hp.com. Follow the document to:
-->Administering a System: Managing System Security
----->Trusted System Security
When you built your system, did you enable the "trusted" option?
Once auditing is enabled, user login and logout times are one of the default actions that are recorded. The following are the event types which default enabled for auditing:
admin - logs all administrative and privileged events
login - logs all system login and logout attempts
moddac - logs all modifications of object access controls
The referenced document walks you through setup and use of the audit functions in HPUX. Fair warning, there is an overhead cost associated with running HPUX/Trusted.
Cheers,
Keith