cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

User last login

Hi all,

One thing I was really hoping R80 would provide is a simple way of reporting on user last login date/time.

I can't find a way to get this info.

Does anyone know how to get this?  I simply want an easy way to report user login, so I can easily see which user accounts haven't been used in the last x weeks/months and target those accounts for deletion.

Anyone got any ideas?  This should be the easiest thing for Check Point to add, and in all these years it still hasn't happened so far as I can tell Smiley Sad

Thanks,

Matt

6 Replies
Admin
Admin

Re: User last login

0 Kudos
Admin
Admin

Re: User last login

Just to clarify, what kinds of accounts are we talking about here: end user accounts (e.g. for VPN) or administrator accounts?

0 Kudos

Re: User last login

Sorry, should have said... I'm on about Check Point VPN user accounts, with Check Point passwords.  Sadly the customer in question about 400 users defined, and no easy way to tell which people are actually using their VPN logins.  I did set about filtering and exporting the Tracker logs with a view to doing to stuff in Excel to get the unique records, but they have one log file per day, and after 7 hours of exporting it was only at 80%, so it would take about 3 months just to export 3 months history of user activity.  Not viable Smiley Sad.  I'm desperate to find a quick and easy way to know which VPN account have/haven't been used in the last 3 months.

0 Kudos
Admin
Admin

Re: User last login

From what I can tell, there is no field in the user database that stores "last login" information.

As such, your only option is to extract it from the logs.

Re: User last login

Hi team,

Is there any option introduced in R80.10 so that user can see the last login with the same username. In web UI and in the dashboard.

0 Kudos
Admin
Admin

Re: User last login

To be clear, these users are different from the ones discussed in this thread. 

However, the answer is the same: you have to extract the information from the various logs:

  • For Gaia WebUI, look in /var/log/messages
  • For SmartConsole, you can see the information in the Audit logs. Also, when a given user logs in, there is a brief popup in the lower right that shows the last time the user logged on.