You might try:
- using a custom script to run "last" command (or parse
lastlog, depending on your OS)
- compare output of above to field #1 in the etc/passwd file
(possibly using "diff" or similarr command)
- alert on those names that show up in the output of the above
step
www.deadcat.net <http://www.deadcat.net/>; has a few scripts that do
almost what you're thinking of, they should be pretty straightforward to
modify.
Dean Casey
From: Ryan Jay B. Lapuz [mailto:user-945139049f37@xymon.invalid]
Sent: Friday, August 10, 2007 6:26 AM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] inactive user accounts
Hi everyone!
Does Hobbit supports monitoring of behavior of user/email accounts like
if the account has been inactive for 30 days?
If not, can someone give me any idea on how to do it?
Thanks in advance
Regards
Ryan