List successful logins for deleted users [SOLVED]
 

Hi,

I want to see a log over successful logins on my Suse 10 machine and just discovered the lastlog command. It gives me the information I want (last time a specific user logged in to the machine), but unfortunately only for current users on the system. I just deleted a user from the machine (using YaST) and now I cannot see him using lastlog (I guess I should only have inactivated it?).

So, what to do? Is there some other log for login attempts (successful most interresting for me), or can I recover/undelete/restore a user some how? I have not deleted the home directory if that's got anything to do with this...

Thanks!

Well, if you've deleted the user, and you didn't mean to, you're going to have to recreate the user.

If you delete a user, they're obviously not active anymore, and won't be able to log in with that ID. You can check auth.log, or your syslogs, and see if there are any ATTEMPTS to log in with that ID, but that'll depend on what level of logging you have set up.

Just rebuild your user, and you should be ok.

I found another command, "last" which I ran in "/var/log" as root. This gave me the list I wanted, and included all logins for all users for the last months. It included logins by users not available in the system anymore (i.e. not only current users as "lastlog" did), so I do no need to restore/rebuild any users. Thanks anyway!