AIX

Originally posted by: aixadmin235

I tried pulling out the data of the last logged on details of the users(eventually i need to pull out the data for all the users).I used the command last -1 <user name > . But i was able to pull the correct data for the users that logged in today(current date) .i checked wtmp file but it also contains the data for the users who logged in today(current day). I do not have sudo right .Can anyone help me extracting the last logindate/time for users in the syste .

Originally posted by: esv

> aixadmin235 wrote:
> I tried pulling out the data of the last logged on details of the users(eventually i need to pull out the data for all the users).I used the command last -1 <user name > . But i was able to pull the correct data for the users that logged in today(current date) .i checked wtmp file but it also contains the data for the users who logged in today(current day). I do not have sudo right .Can anyone help me extracting the last logindate/time for users in the syste .
for user in $( awk -F: '{ print $1}' /etc/passwd)
do
lastlog=$(sudo lsuser -a time_last_login $user | awk -F'=' '{print $NF}')
echo "The last login by $user was on \c"; perl -le "print scalar localtime($lastlog);"
done
best regards,
enrique sanchez.

Originally posted by: esv

ooops, you don't have sudo.....mmm interesting.

Originally posted by: io.loreal.linux

Hello,

 

I have done below script to get only last login users.

 

How to collect AIX servers last login user details with time stamp

 

# sh lastlogindetails.sh

 

#!/bin/sh
for user in $(lsuser -a time_last_login ALL|grep -i time_last_login|awk '{print $1}')
do
lastlog=$(sudo lsuser -a time_last_login $user | awk -F'=' '{print $NF}')
echo "$user \c"; perl -le "print scalar localtime $lastlog;"
done

 

 

output is like below

root Fri Jun 29 11:03:04 2018
iunikao Fri Apr  3 17:48:23 2020
 

-------------------------------------------------

For Additional users which don't have last login date and time stamp informations

#!/bin/sh
for user in $(lsuser -a time_last_login ALL|grep -i time_last_login|awk '{print $1}')
do
lastlog=$(sudo lsuser -a time_last_login $user | awk -F'=' '{print $NF}')
echo "$user \c"; perl -le "print scalar localtime $lastlog;"
done
lsuser -a time_last_login ALL| grep -v time_last_login |grep -vE "daemon|bin|sys|adm|uucp|nobody|lpd|lp|invscout|snapp|ipsec|sshd|root|padmin|guest|nuucp|isso|so|sa"

 

 

Originally posted by: Kosala

If you don't have access to /etc/security/lastlog it's likely that you can't find this. This is where it's stored.

Cheers,
Ko

Originally posted by: ColombianJoker

 for u in $(lsuser -a ALL)


 do


 LAST=$(lsuser -a time_last_login $u |awk '/last_login/{print substr($2,17)}')


 && ( printf "$u "; perl -le "print scalar(localtime($LAST))" )


 done

Originally posted by: esv

> ColombianJoker wrote:
>

 > for u in $(lsuser -a ALL)


 > do


 >   LAST=$(lsuser -a time_last_login $u |awk '/last_login/{print substr($2,17)}')


 >    && ( printf "$u "; perl -le "print scalar(localtime($LAST))" )


 > done


 >

you need to execute that as root or use sudo to call the "lsuser -a time_last_login XXX" command.

regards,
enrique.