AIX system logs files


 
Thread Tools Search this Thread
Operating Systems AIX AIX system logs files
# 1  
Old 02-18-2016
AIX system logs files

hello,

i just want to know logs files for these actions listed below :

- User Account Creation
- User Account Deletion
- Failed and or Successful User Password Changes
- Failed Login Activities for all User Users
- System Reboot or and shutdown

help appreciated...
# 2  
Old 02-18-2016
Quote:
Originally Posted by Bolou
- User Account Creation
- User Account Deletion
There are no logs as these are single commands which have a return code (and some diagnostic messages in case something goes wrong). You might want to write some script wrapper for them and write a log file yourself.

Quote:
Originally Posted by Bolou
- Failed and or Successful User Password Changes
This is not clear enough. The fact that a password is changed is noted in /etc/security/passwd, a file in stanza format, with a lastupdate= entry. Note that this only pertains to locally authenticated users. LDAP-, Kerberos-, ... -users where the AIX system relies on some external system for the authentication do not have password-information on the system and therefore no pasword-update-information.

You might want to read up about "LAM" ("loadable authentication modules") for details.

Quote:
Originally Posted by Bolou
- Failed Login Activities for all User Users
That depends on what you want to know. The lsuser command provides information about the attributes "unsuccessful_login_count". "host_last_unsuccessful_login" and some others (issue lsuser root as root for a complete list of user attributes). You can also configure some authentication mechanisms to use the syslog facilities to write logs. There is nothing out of the box, though, because "authentication" is a loadable, configurable and quasi-external service for AIX.

Quote:
Originally Posted by Bolou
- System Reboot or and shutdown
Is logged in the error log. As a root user enter errpt for an overview and errpt -a for a detailed description of every entry (including shutdown/boot events).

I hope this helps.

bakunin
This User Gave Thanks to bakunin For This Post:
# 3  
Old 02-18-2016
errpt is a good command to use.

also, for the location of the log file where you can find records of the items listed, look in /var/adm/. in this directory, you'll find most files you need to look into.
# 4  
Old 02-19-2016
Quote:
Originally Posted by SkySmart
errpt is a good command to use.

also, for the location of the log file where you can find records of the items listed, look in /var/adm/. in this directory, you'll find most files you need to look into.
thks you very much, i'll see in this directory and i'll come back to you if i have to know others thing...

---------- Post updated at 03:45 AM ---------- Previous update was at 03:35 AM ----------

Quote:
Originally Posted by bakunin
There are no logs as these are single commands which have a return code (and some diagnostic messages in case something goes wrong). You might want to write some script wrapper for them and write a log file yourself.

ok, but are not there a default log file locally for this ? am i neccesary obliged to make a script before ?

This is not clear enough. The fact that a password is changed is noted in /etc/security/passwd, a file in stanza format, with a lastupdate= entry. Note that this only pertains to locally authenticated users. LDAP-, Kerberos-, ... -users where the AIX system relies on some external system for the authentication do not have password-information on the system and therefore no pasword-update-information.

You might want to read up about "LAM" ("loadable authentication modules") for details.



That depends on what you want to know. The lsuser command provides information about the attributes "unsuccessful_login_count". "host_last_unsuccessful_login" and some others (issue lsuser root as root for a complete list of user attributes). You can also configure some authentication mechanisms to use the syslog facilities to write logs. There is nothing out of the box, though, because "authentication" is a loadable, configurable and quasi-external service for AIX.



Is logged in the error log. As a root user enter errpt for an overview and errpt -a for a detailed description of every entry (including shutdown/boot events).

ok, thks
I hope this helps.

bakunin
thks you for all your replies, i understand aix system logs file more and more.....
# 5  
Old 02-19-2016
Hi,

some of these information can also be found under /var/adm.
But it depend on your system configuration.

User login, logout, failed login, etc:
/var/adm/authlog or who /etc/security/failedlogin

Boot, shutdown, reboot:
Binary file /var/adm/wtmp which can be read by the command last, e.g.: last boot,last reboot,last shutdown

Regards
This User Gave Thanks to -=XrAy=- For This Post:
# 6  
Old 03-05-2016
In my quick scan I missed any mention of syslog.

A lot of user related activated in kept in the 'auth' log, and much of that also appears in the 'mail' log.

Where that goes, if at all, depends on /etc/syslog.conf
# 7  
Old 03-29-2016
Thank you.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. UNIX for Beginners Questions & Answers

Daemon logs in AIX

I have to enable sftp and scp daemon logs in AIX 7.1. Currently only ftp daemons are being logged. What are the steps for doing so? Also programs such as filezilla uses sftp service to log into AIX. How do I ensure that sftp/scp continues to function after making change? Also needs to know what... (3 Replies)
Discussion started by: pregmi
3 Replies

2. AIX

Accessing files on AIX system from Linux system

I have a following requirement in production system 1 : LINUX User: abcd system 2: AIX (it is hosting a production DB) Requirement user abcd from system 1 should have read access on archive log files created by DB on system 2. The log files are created with permissions 540 by user ora ,... (2 Replies)
Discussion started by: amitnm1106
2 Replies

3. Red Hat

Writing to System Logs

This isn't a RedHat specific question. The software in question might be used for any Linux distribution. Would it be advisable or inadvisable for my application, to be downloaded by many people I don't know, to write to the following logs in /var/log? maillog or mail.log messages secure ... (10 Replies)
Discussion started by: Brandon9000
10 Replies

4. Shell Programming and Scripting

AIX system.... deleting files in remote directory after retrieving files

Hi Friends, I am new to this , I am working on AIX system and my scenario is to retrive the files from remote system and remove the files from the remote system after retreving files. I can able to retrieve the files but Can't remove files in remote system. Please check my code and help me out... (3 Replies)
Discussion started by: vinayparakala
3 Replies

5. AIX

system logs

good evening all dear all where i can find the system logs in AIX 5.3 (1 Reply)
Discussion started by: thecobra151
1 Replies

6. Solaris

logs for system shutdown

I am working on a SUN T2000 machine with Solaris 10 running on it. When I checked the system this morning, I found it to be turned off. The lastreboot command showed that the system had been shut down the previous night. I want to find out how the system was shut down. I have run hardware health... (2 Replies)
Discussion started by: batman727
2 Replies

7. AIX

How to transfer files from AIX to AS400/i-series Integrated File System

Hi all, We (AIX) currently mount to a ZFS on the Mainframe. When one of our local users wants to transfer a file to the Mainframe, they must first run binary MVSLOGIN passing user name and password. Our mainframe will be retired soon and business processes will be transferring to an... (2 Replies)
Discussion started by: cruiser
2 Replies

8. AIX

System Logs

Dear Gurus I am running AIX with several users that are using the system, i would like to monitor the commands that are run by these users. Is there a log system that records the commands that are executed by the users??? Any kind of help will be appreciated. Regards Masquerder (6 Replies)
Discussion started by: masquerer
6 Replies

9. AIX

location of logs on AIX 4.3 and 5.3

Hi All, I would like to know where's the location of ALL system error logs on AIX43 and AIX53. Thanks, itik (1 Reply)
Discussion started by: itik
1 Replies

10. Solaris

system logs' life

How can you control old system logs keep(or storage) time in Solaris ? Is there any method ? it depends on buffer size long or date long ? (1 Reply)
Discussion started by: xramm
1 Replies
Login or Register to Ask a Question

Featured Tech Videos