0

Ok, so, this a SuSE specific question becoause on CentOS or Debian I wold look on /var/log/secure but there isn't such log on suse, so.. How can I know the creation date of a user on Suse (v12 or newer)?

Improve this question

1 Answer 1

Reset to default
0

run the following commands:

grep -i [USERNAME] /var/log/audit

from the output take the value inside the parenthesis

msg=audit(xxxxxxx.xxx)

then run the command

date --date='@xxxxxx.xxx'

And you get the date when the user was created

Improve this answer
1
  • Ok, I like were this is going but, al the entries looks like type=USER_AUTH msg=audit(1629592296.742:533): pid=2023 uid=0 auid=4294967295 ses=4294967295 subj==unconfined msg='op=PAM:authentication grantors=pam_permit acct="sata" exe="/usr/lib/sddm/sddm-helper" hostname=? addr=? terminal=? res=success' I just check the first one? Because it's look like a command that the user run, what of a user that exist but never run a command? Thanks in advance
    – sataranights
    Aug 30, 2021 at 19:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .