Subject: tracking logins

From: R Cent <[email-masked]>
Date: Wed, 25 Apr 2001 06:46:06 -0700 (PDT)

Hi,

What is the best way to determine the last time a Mac user has
logged into a linux server?  Logging in through Netatalk does
not record information that the "finger" command can show.
Thanks.

_____________________________
Bob Cent
University of Washington
Box 357330
Seattle, WA  98195-7330

mailto: [email-masked]
voice:  206.543.1433
fax:    206.685.0305
_____________________________

---

From: Cliff Crawford <[email-masked]>
Date: Wed, 25 Apr 2001 10:36:59 -0400

> not record information that the "finger" command can show.

Each login is recorded in /var/log/messages, and looks something like
this:

Apr 25 10:04:08 <hostname> afpd[30447]: ASIP session:548(2) from
<ip address>:49155(0)
Apr 25 10:04:08 <hostname> afpd[30447]: dhx login: <username>
Apr 25 10:04:08 <hostname> PAM_pwdb[30447]: (netatalk) session opened for user
<username> by (uid=0)
Apr 25 10:04:08 <hostname> afpd[30447]: login <username> (uid 135, gid 111)

(Where <hostname> is the hostname of the linux server, <username> is who
logged in, and <ip address> is the ip address of the mac they logged in
from.)  So you could write a perl script or something to grep
/var/log/messages for the user in question.

-- 
Cliff Crawford   http://www.sowrong.org/
birthday party cheesecake jellybean BOOM

---

From: R Cent <[email-masked]>
Date: Wed, 25 Apr 2001 07:48:55 -0700 (PDT)

> this...

Cliff,

Thanks for the reply.

I have examined the /var/log/messages,
/var/log/messages1,..../var/log/messages4 on my server.  Each
contain a week's worth of logins.  My server has been up for
about 4 months yet I only have five weeks of log-in records.
This doesn't help if I want to see if a user hasn't use his
account with in several months.

Does your system keep /var/log/messages farther back in time?

---

From: Cliff Crawford <[email-masked]>
Date: Wed, 25 Apr 2001 11:12:44 -0400

> Does your system keep /var/log/messages farther back in time?

No, but I haven't needed to go back that far yet :)  The logs are
rotated by a cron script, so you could just set it to do it monthly
instead of weekly.

---

From: charlie wood <[email-masked]>
Date: Wed, 25 Apr 2001 08:20:25 -0700

Something to try to help weed through the log file:

grep '[client_IP_address]' /var/log/messages > seek.txt

will search the syslog files for the quoted string and burp it all into a
file called 'seek.txt', which you can then search more reasonably.

you could also try using 'afpd' or 'atalkd' as your string.

</charlie>

-------original message-------

> From: R Cent <[email-masked]>
> Date: Wed, 25 Apr 2001 07:48:55 -0700 (PDT)
> To: Cliff Crawford <[email-masked]>
> Cc: netatalk mailing list <[email-masked]>
> Subject: Re: tracking logins
> Resent-From: [email-masked]
> Resent-Date: Wed, 25 Apr 2001 10:53:12 -0400 (EDT)
> 
> 
> Cliff,
> 
> Thanks for the reply.
>

---

From: Carsten Neumann <[email-masked]>
Date: Fri, 27 Apr 2001 01:13:42 +0200

> rotated by a cron script, so you could just set it to do it monthly

SuSE has an interesting log backup mechanism:
In a cron.daily script several log files are checked if they reached a given size.
If so they are backed-up to <log-file>-<date>.gz files.
They exist until you delete them.

The pathnames, max. sizes, etc. are defined in /etc/logfiles.

I kept all logfiles since I installed linux onto my box.
So I have all log information for over one year accessible.

Kind regards

	Carsten