John, Is the problem "expiring" accounts or is it identifying account not accessed over 6 months? Or is it both? In addition, the other problem is that Frontpage, Samba, and pop3 don't leave a trace of when last logged on? So then part of the problem is finding IF a log file exists for these 3 login types, right? Which ports do frontpage, samba, and pop3 log use on the server? pop3 is it not port 110? Robert John Madden wrote: > Scenario: I need to be able to expire system accounts that go unused for > more than, say, 6 months. > > Problem: Lastlog is the only source of information that I'm aware of that > really provides an easy means of tracking when a user last logged in. > Telnet, SSH, and FTP all log there nicely, but Frontpage, Samba, and pop3 > don't. > > Solution: Log parsing? Sure, all of this stuff is logged in different > places, but writing something to track each log when logs get rotated and > whatnot isn't very practical (and quite complicated to begin with). > Ignore the problem, and disable their accounts anyway? Sure, but many of > our users aren't even aware of the fact that "oh, there's something *other > than* Frontpage?!" > > So any other ideas? > > Thanks, > John