User last login

[Matt_Dunn]

Hi all,

One thing I was really hoping R80 would provide is a simple way of reporting on user last login date/time.

I can't find a way to get this info.

Does anyone know how to get this?  I simply want an easy way to report user login, so I can easily see which user accounts haven't been used in the last x weeks/months and target those accounts for deletion.

Anyone got any ideas?  This should be the easiest thing for Check Point to add, and in all these years it still hasn't happened so far as I can tell

Thanks,

Matt

[Moti]

Tomer Sole​

[PhoneBoy]

Just to clarify, what kinds of accounts are we talking about here: end user accounts (e.g. for VPN) or administrator accounts?

[Matt_Dunn]

Sorry, should have said... I'm on about Check Point VPN user accounts, with Check Point passwords.  Sadly the customer in question about 400 users defined, and no easy way to tell which people are actually using their VPN logins.  I did set about filtering and exporting the Tracker logs with a view to doing to stuff in Excel to get the unique records, but they have one log file per day, and after 7 hours of exporting it was only at 80%, so it would take about 3 months just to export 3 months history of user activity.  Not viable .  I'm desperate to find a quick and easy way to know which VPN account have/haven't been used in the last 3 months.

[PhoneBoy]

From what I can tell, there is no field in the user database that stores "last login" information.

As such, your only option is to extract it from the logs.

[Jubish_Ramakris]

Hi team,

Is there any option introduced in R80.10 so that user can see the last login with the same username. In web UI and in the dashboard.

[PhoneBoy]

To be clear, these users are different from the ones discussed in this thread. 

However, the answer is the same: you have to extract the information from the various logs:

• For Gaia WebUI, look in /var/log/messages
• For SmartConsole, you can see the information in the Audit logs. Also, when a given user logs in, there is a brief popup in the lower right that shows the last time the user logged on.

[acuthbert]

Hello,

Was just looking into this myself and created something that works for my purposes.

Create View based on Access Control.

Filter: Blade = Mobile Access

Add Table
Type = Statistical Table
Add:
User (increased number of values),
Time (show each value on separate row with Summary Row) and
Action

Filter:
Client name "contains" Endpoint;
Action = Login

Change the time window in the query bar.

Hope that helps.

[hemh]

Your detailed explanations helped me a lot, but I brought few modifications to be able to get the last login for all our Mobile access users(about 1200) for the last year, here is the detail:

In the statistical table:

User - increased the nbr of value - show each value on a separate row - sort value by: User ascending

Time - advanced - aggregate value by: Maximum

Action

Filters:

only filter Action = Log In

The rapport takes 5mn to be ready, works like a charm.