up vote 0 down vote favorite
share [g+] share [fb]

We run samba as primary domain controller using ldap for the user account settings. As the title says, I am looking for an easy way to get the last logon times for each of those domain users.

I could generate a script to lookup all usernames from either pam or ldap and grep the samba log files, which might be error prone. I guess there is already an intended way of doing that.

So, how to get the last logon time for each user on any/all Windows machine(s)?

link|improve this question
feedback

2 Answers

up vote 2 down vote accepted

I haven't used samba + LDAP for a while, but I remember there being sambaLogonTime and sambaLogoffTime attributes in the schema.

The samba-ldap howto mentions these attributes

However, I'm not sure if these are populated automatically. This link suggests that they aren't, although that's quite old now. I didn't need to use these attributes, so I didn't really pay any attention to them

link|improve this answer
This configuration of ldap is a bit outdated, I remember setting up the config via ldif import. As of today there a no sambaLogo{n|ff}Time stamps set (0 and unix_max). – mbx Mar 16 '11 at 21:43
1  
I think the LDIF in that howto is misleading when it sets those attributes to 0 and unix_max. Certainly. sambaLogo{n|ff}Time attributes are still present in the schema (I just downloaded 3.5.7 and checked). The second link I posted suggests that these values aren't populated by default, that you need to use a preexec script to update the sambaLogonTime attribute manually. Not sure what you can do about sambaLogoffTime, but this looks like it meets your requirements at least – Daniel Lawson Mar 17 '11 at 3:27
feedback
up vote 0 down vote

The quick and dirty solution is to "merge" the machine logfiles and grep for logons

cat /var/log/samba/log.* |grep -A 1 make_connection_snum > logons.txt

Thus you get the entries for accessing their homedir when logging in. Sorting by time and user seems like a job for a simple perl script.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.