I'm trying to find the last user to log into our unix system from a
specific terminal.
Now all i have is the IP address - and i cant seem to find the data i
need.

I routed about and found the /etc/wtmpx file, which when viewed with
last seems to almost give me what i need, except there are a lot of
blanks where the IP (hostname) should be - and the IP i'm after isn't
shown, so i would guess it is one of those blanks.....

Any ideas from some of you seasoned veterans where i might find it?

(SCO 3.9 if it helps at all.)

[ Post a follow-up to this message ]

In article
<559a5852-1ffe-42d2-956b-858c4ace39c7@l32g2000hsh.googlegroups.com>,
James <jamesb457@gmail.com> wrote:

> I'm trying to find the last user to log into our unix system from a
> specific terminal.
> Now all i have is the IP address - and i cant seem to find the data i
> need.
>
> I routed about and found the /etc/wtmpx file, which when viewed with
> last seems to almost give me what i need, except there are a lot of
> blanks where the IP (hostname) should be - and the IP i'm after isn't
> shown, so i would guess it is one of those blanks.....
>
> Any ideas from some of you seasoned veterans where i might find it?
>
> (SCO 3.9 if it helps at all.)

If it's blank, it should mean that they didn't login over the network.
Unless you have some remote login daemons that don't record the client
IP/hostname.

--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***

[ Post a follow-up to this message ]

James wrote:
> I'm trying to find the last user to log into our unix system from a
> specific terminal.
> Now all i have is the IP address - and i cant seem to find the data i
> need.
>
> I routed about and found the /etc/wtmpx file, which when viewed with
> last seems to almost give me what i need, except there are a lot of
> blanks where the IP (hostname) should be - and the IP i'm after isn't
> shown, so i would guess it is one of those blanks.....
>
> Any ideas from some of you seasoned veterans where i might find it?
>
> (SCO 3.9 if it helps at all.)

If "last" doesn't find it, you can use a separate system log.

In a system login shell

(/etc/login /etc/.login /etc/csh.login,
/etc/profile /etc/.profile ...)

add this code:

who am i >> /tmp/writable_loginlog


--
Michael Tosch @ hp : com

[ Post a follow-up to this message ]