3

I'm trying to output the result of "useradd" to a logfile, but unfortunately there is no verbose option. For example: "useradd dude" has no output, unless the user already exists.

I would like to do something similar to: useradd -v dude > $logfile

I suppose I could check the result code and if 0 query the user's UID and GID and write it to the logfile, for example:

log=logfile
un=dude
if useradd ${un} &>> $log; then
  uu=$(getent passwd ${un} | cut -d: -f3)
  ug=$(getent passwd ${un} | cut -d: -f4)
  uh=$(getent passwd ${un} | cut -d: -f6)
  echo "User ${un} UID:${uu} GID:${ug} ${uh} successfully added." >> $log
fi 


# cat logfile
User dude UID:1000 GID:1000 /home/dude successfully added.
useradd: user 'dude' already exists

but I wonder if there's an easier option.

OS: RHEL 7.7

Parsing /var/log/secure might be another idea:

un=dude
useradd ${un} 2>&- &
bpid=$!
wait $bpid
ret=$?
sync
(grep "useradd\[${bpid}\]" /var/log/secure | tail -n 2) >> logfile

if [[ ${ret} -eq 0 ]]; then
  echo do whatever you need to do
else
  echo error
  exit 1
fi

# ./abc
do whatever you need to do
# ./abc
error

# cat logfile
Aug 24 03:48:07 vm7031 useradd[4929]: new group: name=dude, GID=1000
Aug 24 03:48:07 vm7031 useradd[4929]: new user: name=dude, UID=1000, GID=1000, home=/home/dude, shell=/bin/bash
Aug 24 03:48:09 vm7031 useradd[4940]: failed adding user 'dude', exit code: 9

It seems to require a sync though, otherwise grep won't work. Not sure, seems all a bit overkill.

2

OPTION 1 (RHEL,DEBIAN)

Here are two additional possibilities available to RHEL, based on inotify-tools (these are not installed by default as far as I remember). The /dev/null pipe is to prevent stdout to the terminal, because -qq was not as quiet as described.

For DEBIAN distributions, change /var/log/secure to /var/log/auth.log, and obviously sudo , but actually logging in as root - to set up this type of system-wide monitoring - might actually be one of those appropriate usages of root.

1.Monitoring the /var/log/secure changes in the background:

    while inotifywait -qq -e modify /var/log/secure; 
       do 
       if tail -n1 /var/log/secure | grep useradd > /dev/null; 
         then 
           tail -n1 /var/log/secure | grep useradd >> ~/useradd.log; 

           echo "Here you can also add conditional action if user already exists";    

       fi; 
    done &

I really like this particular option because it allows compartamentalization of different parts (useradd, pam etc.) of the auth.log or secure logs into separately monitored sublogs.

2.Monitoring usage of useradd command itself

while inotifywait -qq /usr/sbin/useradd; 
   do  
    if tail -n1 /var/log/secure | grep useradd > /dev/null; 
        then  tail -n1 /var/log/secure | grep useradd >> ~/useradd.log ;          
    fi; 
  done  &

Either option packaged as a script and executed with nohup [script] > /dev/null will monitor continuously in the background even when the terminal gets closed.

OPTION 2 (DEBIAN)

Or even better option in your case might be to use adduser instead and create /usr/local/sbin/adduser.local which will be executed after adduser command completes

if you create adduser.local as follows:

#!/bin/bash

# arguments passed in the following order: username uid gid home-directory
    #adjust log path accordingly

echo "ADDUSER: $1 $2 $3 $4 $5" >> ~/adduser.log

This should get the logfile appended whenever a new user gets created

OPTION 3 (ALL)

Yes, the output of useradd actually gets appended to /var/log/auth.log

tested it as an example (sudo before commands obviously)

$useradd dude
$cat /var/log/auth.log | tail -2

Aug 23 19:01:25 useradd[32230]: new group: name=dude, GID=1012
Aug 23 19:01:25 useradd[32230]: new user: name=dude, UID=1011, GID=1012, home=/home/dude, shell=/bin/sh

$useradd dude
$cat /var/log/auth.log | tail -1 

Aug 23 19:04:16 useradd[32328]: failed adding user 'dude', data deleted

All in all, I believe what you are looking for is:

$ sudo grep -a "useradd" /var/log/auth.log

And that will give you all the log entries with the names and times users were added to the system.

  • That's not a bad idea, but what are the odds? For example, someone could login in at the very same time, thus tail catching the wrong log. It would be best to query the PID. Btw, RHEL 7 uses /var/log/secure. – Dude Aug 24 '19 at 1:50
  • Also, I just need the log of the specific user, not all of them. – Dude Aug 24 '19 at 1:59
  • I completely forgot that you can also use adduser [username] --debug for more verbose output when adding users – BarBar1234 Aug 24 '19 at 3:13
  • Additionally with adduser you can extend that command by adding /usr/local/sbin/adduser.local which will be executed after adduser completes. I updated my answer – BarBar1234 Aug 24 '19 at 3:21
  • But then again, I cannot guarantee you will have adduser on RHEL – BarBar1234 Aug 24 '19 at 3:29
1

It seems useradd or adduser options are more limited on RHEL 7 compared to other distributions. I've decided to do the following:

useradd ${un} 2>&- &
pid=$!; wait $pid; sync
{ grep "useradd\[${pid}\]" ${authlog} | tail -n 2; } >> ${logfile}

Then I simply verify whether the user exists and continue accordingly.

This will execute useradd in the background, which is necessary so that $! will show me the PID of that particular process. It will then search /var/log/secure for the process ID in reverse order and write the output to my own logfile. A sync or pause (sleep 3) is necessary, but it should not hurt performance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.