do you have access to last on your system?
last username | more will reveal the information provided the files where that data is stored are not wiped periodically.
Main Topics
Browse All TopicsHello All,
I want to find last login time of users on HP-UX. Can anyone have idea how can I find users who didnt logged in since last 6 months on HP-UX?
Hoping for quick reply......
Reagards,
Pralay Desai
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
This can be a bit tricky. You can use gheits approach, but that will only give the last login time of those users that have entries in the wtmp file. If a user never logged in, or if he/she haven't logged in since the last time the wtmp file was truncated, they won't show up at all. (wtmp isn't auto truncated, but some sysadm do this from time to time because of space issues. I don't know if that is the case with you system, but I'm just pointing it out just in case.)
To find out a complete list of users that hasn't logged in past 6 months you will need to do something like this:
Use gheists example to get a listing of users with entries in the wtmp file, and make a note of the users where the dates are older then 6 months.
Then you will need to print a listing of the users from the passwd file, filter out the system users, and compare this with the complete userlisting of usernames from gheists example. The difference will give you all users without entries in the wtmp file. This will give you the users who never logged in at all. (Or more correctly: Users who hasn't logged in since the last time wtmp was truncated).
These two steps should give you the answer you are looking for I think. The thing to note is that in order for this to work correctly, you need to know that none of the sysadmins have truncated the file the last 6 months. If this is the case, then you should be fine. If this isn't the case, then you don't have any way of knowing if they logged in last 6 months or not. I don't think there is any way around this.
I hope this was more helpful then confusing :-)
On Solaris even if the wtmpx file is truncated you can use finger [username]. We generally finger each user in the passwd file, strip the Last Login date and time, use a bit of perl to find out if its in the last 6 months, and either disable the account or write out that it needs disabling.
ie: as below (roots logged in before, nobody never has).
bash-3.00$ finger root
Login name: root In real life: Super-User
Directory: / Shell: /sbin/sh
Last login Fri Nov 4 22:13 on console
New mail received Fri Nov 4 20:02:08 2005;
unread since Sat Oct 29 14:28:33 2005
No Plan.
bash-3.00$ finger nobody
Login name: nobody In real life: NFS Anonymous Access User
Directory: /
Never logged in.
No unread mail
No Plan.
Business Accounts
Answer for Membership
by: gheistPosted on 2005-09-08 at 21:45:44ID: 14849966
awk -F: '{print $1}' /etc/passwd | xargs -n 1 last | egrep -v '^wtmp'