UNIX for Advanced & Expert Users

last unix command shows the list of last logged-in users. But the usernames are trimmed to eight characters.

Is there any other way to get the full login name of last loggedin user ?

I tried lastlog command, but this command not listing user info in some machines.

Which Unix and what version are you talking about?

lastlog works on Linux, but on most commercial UNIX systems like Solaris, this is not included. But, you can easily make a shell script to compare output of last with /etc/passwd. You need to tell us what exactly you are trying to do, so that we can help you better.

This is my quick script which can tell you who all logged on to the system and their last logon time, obviously the rest of the user listed in /etc/passwd file never logged in:

Code:

last | awk '{print $1}' | sort | uniq | sed -e '/^$/d; /^wtmp/d' | while read i; do last | grep $i | tail -1; done

In most versions of unix the maximum length of the username field is 8 characters. Longer username fields can be allowed but the effects are unpredictable.
See on your unix system:

Code:

man 4 passwd

It could be quite different for your Linux.

Btw. If you have the "fwtmp" utility it should display whatever is in the wtmp file.

Hi Everyone,

Thank you for your replies.

I try to identify the owner of a linux machine with login history. I used last unix command to get the list,parse and get the first username from the list. This is my assumption. But last command shows only 8 characters and i am looking for some other solution to my problem. Sorry for not explain this in my previous post.

Please let me know, is there any alternate way to find the owner (one of the login names) in linux machines.

I have this issue in Redhat 8+,Ubuntu-10.X and in Mandriva 2010 version

You have to use last with -w switch which shows the full logon id of a user:

Code:

last -w

I do not think there's any other way of checking the owner of the machine. But, the files where the last command checks gets the information (/var/log/wtmp) can be deleted by a log maintenance program like logrotate. So, you may want to verify the first login time of the suspected machine owner with the "modify" time of one of the files like .profile or .bash_profile in root's home directory /root. These files get created when the root account gets created i.e during the installation. If nobody has changed the content of these files, the modify time will be the same as the file creation time.

Code:

# stat /root/.bash_profile
  File: `/root/.bash_profile'
  Size: 176             Blocks: 8          IO Block: 4096   regular file
Device: 802h/2050d      Inode: 795840      Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2011-11-22 18:21:32.962989477 -0800
Modify: 2009-05-20 03:45:02.000000000 -0700
Change: 2011-11-21 04:15:47.124320704 -0800

These are not convenient ways of determining the exact owner of the machine. But, still you can work your way out with these. If you are working on production environment, I would suggest that you implement a schema for each ID creation and tag the IDs with information like who requested for that ID, etc.

Hope this helps.

Thank you for your suggestion. I will try at my end.