Hello,
I've a script that verifies users connections.
This is the check part

do
NEVER=$(finger $USER | grep -i Never)
 if [ "$NEVER" != "" ]
 then
    NAME=$(finger $USER | grep -i "In real life" | sed -e 's/^.*life: //')
    echo $USER $NAME >> never_logged #" "$NEVER
 fi
done

wtmp begins Wed Jul  x xx:xx

SERVER$ finger user
Login name: user                     In real life: Name Surname
Directory: $USERHOME       Shell: /bin/ksh
Never logged in.
No unread mail
No Plan.

SERVER$ ls -la $USERHOME/.sh_history
-rw-------   1 user  groupe     111111 Nov 26 10:02

Do you KNOW (first hand knowledge from obervation with truss/trace/opensource) what finger does - what files it reads - on your box?

What OS do you have?

My first guess is that there is a disconnect between finger's actual implementation and what you think it does.

Finger reads "wtmp". If wtmp does not exist, or is empty, or has wrong permissions, finger will return "Never logged in".


What does this give?

last -R username

@jim mcnamara
I supposed the same... but I don't find any trace :-/

munmap(0xEF750000, 8192)                        = 0
open("/etc/passwd", O_RDONLY)                   = 3
open("/var/adm/lastlog", O_RDONLY)              = 4
open("/var/adm/utmpx", O_RDWR|O_CREAT, 0644)    Err#13 EACCES
open("/var/adm/utmpx", O_RDONLY)                = 6
open("/var/adm/utmpx", O_RDONLY)                = 7
access("/var/adm/utmp", 0)

-rw-r--r--   1 root     group  33654 Nov 30 09:54 wtmp
-rw-r--r--   1 root     group  894587 Nov 30 09:54 wtmpx

/here/i/am% last $USER

wtmp begins Wed Jul  x xx:xx

methyl - I have not seen a POSIX specification for finger stating that it reads any given file. However, it does read other accounting files. See above. On Solaris, finger reads /var/adm/utmpx. Read the man page.


Gogol - It looks like wtmp is being updated. last should work as methyl indicated but without the -R. There are also wtmpx entries on your system. wtmp is written to only if the file exists, and for you is not part of the picture for finger.
what does

ls -l /var/adm/utmp

finger is ready to try to match stuff in the gecos field and it marches to its own beat with respect to user names. You have concealed the user's real name and that is probably what is wrong. Is the is user name a mix of 8 characters or less of all lower case letters or digits?

Looked more closely at the original post. Could multiple matches with text in the password file.

Preferable syntax makes an exact match on the username.