[alcimedes]

Is there any log, file or app. that tracks a user's login/logout times?

[chucker]

You can install the Common Criteria Tools to add a highly configurable auditing facility to OS X. It's explained in more detail in Amit Singh's book: http://books.google.com/books?id=K8v...sult#PPA144,M1

[Taskiss]

Try "last -1 USERID", and try it without the "-1" (minus one), then try it without the USERID

[Kickaha]

Finally, try it without the 'last'.


What? I'm trying to be complete here!

[curiousuburb]

Local machine or wifi/router access logs?
Single user or multi-user machine?
Which OS version?

[alcimedes]

10.5.5, single user, hardwired to the network.

What's last USERID returning?

[Taskiss]

Originally Posted by alcimedes 10.5.5, single user, hardwired to the network. What's last USERID returning?

On another UNIX varient:

$ last -1 user228user228   pts/0        Mon Sep 22 14:13   still logged in$ last user228user228   pts/0        Mon Sep 22 14:13   still logged inuser228   pts/1        Mon Sep 22 08:27 - 08:59  (00:31)user228   pts/1        Thu Sep 18 14:08 - 15:09  (01:01)user228   pts/0        Wed Sep 17 09:39 - 10:07  (00:28)...$ last... reams and reams of all login records...

"last -1 USERID" returns the last record of that user, "last USERID" returns all records for that user, "last" returns all records of every user since the beginning of time, as that computer understands it.

Do a "man last" for further details.

[alcimedes]

Hmm, showing login times that don't correspond with login/logout times.

Last is no good.

[Brad]

It looks like the Mac version of last only shows stats for shell connections, not GUI login/logouts. Looking at it from that perspective, the times appear to coincide correctly for me.

[alcimedes]

Yeah, this isn't a shell issue though.

I think the system.log will be good enough in this case. I was looking for something tied to the login window itself. system appears to be at least somewhat in this case. (user wasn't ever logging out at all, so it kind of skews it)