|
Home > Archive > Unix administration > December 2007 > Last user to login from a given IP
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
Last user to login from a given IP
|
|
|
| I'm trying to find the last user to log into our unix system from a
specific terminal.
Now all i have is the IP address - and i cant seem to find the data i
need.
I routed about and found the /etc/wtmpx file, which when viewed with
last seems to almost give me what i need, except there are a lot of
blanks where the IP (hostname) should be - and the IP i'm after isn't
shown, so i would guess it is one of those blanks.....
Any ideas from some of you seasoned veterans where i might find it?
(SCO 3.9 if it helps at all.)
| |
| Barry Margolin 2007-12-19, 7:27 pm |
| In article
<559a5852-1ffe-42d2-956b-858c4ace39c7@l32g2000hsh.googlegroups.com>,
James <jamesb457@gmail.com> wrote:
> I'm trying to find the last user to log into our unix system from a
> specific terminal.
> Now all i have is the IP address - and i cant seem to find the data i
> need.
>
> I routed about and found the /etc/wtmpx file, which when viewed with
> last seems to almost give me what i need, except there are a lot of
> blanks where the IP (hostname) should be - and the IP i'm after isn't
> shown, so i would guess it is one of those blanks.....
>
> Any ideas from some of you seasoned veterans where i might find it?
>
> (SCO 3.9 if it helps at all.)
If it's blank, it should mean that they didn't login over the network.
Unless you have some remote login daemons that don't record the client
IP/hostname.
--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***
| |
| Michael Tosch 2007-12-20, 7:36 am |
| James wrote:
> I'm trying to find the last user to log into our unix system from a
> specific terminal.
> Now all i have is the IP address - and i cant seem to find the data i
> need.
>
> I routed about and found the /etc/wtmpx file, which when viewed with
> last seems to almost give me what i need, except there are a lot of
> blanks where the IP (hostname) should be - and the IP i'm after isn't
> shown, so i would guess it is one of those blanks.....
>
> Any ideas from some of you seasoned veterans where i might find it?
>
> (SCO 3.9 if it helps at all.)
If "last" doesn't find it, you can use a separate system log.
In a system login shell
(/etc/login /etc/.login /etc/csh.login,
/etc/profile /etc/.profile ...)
add this code:
who am i >> /tmp/writable_loginlog
--
Michael Tosch @ hp : com
|
|
|
|
|