Historic Last Login for All Users

[five]

I had a request to find the last login for all users on my 3.5 Viya environment going back to August 2021.

Using the Audit CLI plugin, I was able to pull in the last seven days, so that wasn't super useful for this scenario. I then got the last modified timestamp of the ~/sasuser.viya folder for every user. In some cases, that appears to be close enough. But in at least one case, for one of my regular SAS Studio users, they haven't modified that folder going back 3 years, even though they are on the system every day. Some of my users do not even have that folder. I don't know if that means they have never logged in. Or if only certain tools create that folder.

I am curious if anyone has any suggestions or tricks for gathering this info for things that have aged out of the logs at this point. The main use cases in my environment are VA, CAS, and SAS StudioV. We are using LDAP to log in, if that makes a difference, and the login shell is set to /sbin/nologin; they only access the system via the GUI.

I do have a ticket open with support about this as well.

[gwootton]

The audit functionality is how Viya would surface this information. The sasuser.viya directory is used by the compute server started when using SAS Studio, so would not apply to any user logging into the system.
If your LDAP server logs bind attempts you might be able to capture the information from there.