0

Ok, so, this a SuSE specific question becoause on CentOS or Debian I wold look on /var/log/secure but there isn't such log on suse, so.. How can I know the creation date of a user on Suse (v12 or newer)?

sataranights
  • 3
  • 1

1 Answers1

0

run the following commands:

grep -i [USERNAME] /var/log/audit

from the output take the value inside the parenthesis

msg=audit(xxxxxxx.xxx)

then run the command

date --date='@xxxxxx.xxx'

And you get the date when the user was created

Alejandro F.
  • 497
  • 3
  • 8
  • Ok, I like were this is going but, al the entries looks like type=USER_AUTH msg=audit(1629592296.742:533): pid=2023 uid=0 auid=4294967295 ses=4294967295 subj==unconfined msg='op=PAM:authentication grantors=pam_permit acct="sata" exe="/usr/lib/sddm/sddm-helper" hostname=? addr=? terminal=? res=success' I just check the first one? Because it's look like a command that the user run, what of a user that exist but never run a command? Thanks in advance – sataranights Aug 30 '21 at 19:46