Mdthbs

I'm trying to output the result of "useradd" to a logfile, but unfortunately there is no verbose option. For example: "useradd dude" has no output, unless the user already exists.

I would like to do something similar to: useradd -v dude > $logfile

I suppose I could check the result code and if 0 query the user's UID and GID and write it to the logfile, for example:

log=logfile

un=dude

if useradd ${un} &>> $log; then

  uu=$(getent passwd ${un} | cut -d: -f3)

  ug=$(getent passwd ${un} | cut -d: -f4)

  uh=$(getent passwd ${un} | cut -d: -f6)

  echo "User ${un} UID:${uu} GID:${ug} ${uh} successfully added." >> $log

fi 





# cat logfile

User dude UID:1000 GID:1000 /home/dude successfully added.

useradd: user 'dude' already exists

but I wonder if there's an easier option.

OS: RHEL 7.7

Parsing /var/log/secure might be another idea:

un=dude

useradd ${un} 2>&- &

bpid=$!

wait $bpid

ret=$?

sync

(grep "useradd[${bpid}]" /var/log/secure | tail -n 2) >> logfile



if [[ ${ret} -eq 0 ]]; then

  echo do whatever you need to do

else

  echo error

  exit 1

fi



# ./abc

do whatever you need to do

# ./abc

error



# cat logfile

Aug 24 03:48:07 vm7031 useradd[4929]: new group: name=dude, GID=1000

Aug 24 03:48:07 vm7031 useradd[4929]: new user: name=dude, UID=1000, GID=1000, home=/home/dude, shell=/bin/bash

Aug 24 03:48:09 vm7031 useradd[4940]: failed adding user 'dude', exit code: 9

It seems to require a sync though, otherwise grep won't work. Not sure, seems all a bit overkill.

OPTION 1 (RHEL,DEBIAN)

Here are two additional possibilities available to RHEL, based on inotify-tools (these are not installed by default as far as I remember). The /dev/null pipe is to prevent stdout to the terminal, because -qq was not as quiet as described.

For DEBIAN distributions, change /var/log/secure to /var/log/auth.log, and obviously sudo , but actually logging in as root - to set up this type of system-wide monitoring - might actually be one of those appropriate usages of root.

1.Monitoring the /var/log/secure changes in the background:

    while inotifywait -qq -e modify /var/log/secure; 

       do 

       if tail -n1 /var/log/secure | grep useradd > /dev/null; 

         then 

           tail -n1 /var/log/secure | grep useradd >> ~/useradd.log; 



           echo "Here you can also add conditional action if user already exists";    



       fi; 

    done &

I really like this particular option because it allows compartamentalization of different parts (useradd, pam etc.) of the auth.log or secure logs into separately monitored sublogs.

2.Monitoring usage of useradd command itself

while inotifywait -qq /usr/sbin/useradd; 

   do  

    if tail -n1 /var/log/secure | grep useradd > /dev/null; 

        then  tail -n1 /var/log/secure | grep useradd >> ~/useradd.log ;          

    fi; 

  done  &

Either option packaged as a script and executed with nohup [script] > /dev/null will monitor continuously in the background even when the terminal gets closed.

OPTION 2 (DEBIAN)

Or even better option in your case might be to use adduser instead and create /usr/local/sbin/adduser.local which will be executed after adduser command completes

if you create adduser.local as follows:

#!/bin/bash



# arguments passed in the following order: username uid gid home-directory

    #adjust log path accordingly



echo "ADDUSER: $1 $2 $3 $4 $5" >> ~/adduser.log

This should get the logfile appended whenever a new user gets created

OPTION 3 (ALL)

Yes, the output of useradd actually gets appended to /var/log/auth.log

tested it as an example (sudo before commands obviously)

$useradd dude

$cat /var/log/auth.log | tail -2



Aug 23 19:01:25 useradd[32230]: new group: name=dude, GID=1012

Aug 23 19:01:25 useradd[32230]: new user: name=dude, UID=1011, GID=1012, home=/home/dude, shell=/bin/sh



$useradd dude

$cat /var/log/auth.log | tail -1 



Aug 23 19:04:16 useradd[32328]: failed adding user 'dude', data deleted

All in all, I believe what you are looking for is:

$ sudo grep -a "useradd" /var/log/auth.log

And that will give you all the log entries with the names and times users were added to the system.

It seems useradd or adduser options are more limited on RHEL 7 compared to other distributions. I've decided to do the following:

useradd ${un} 2>&- &

pid=$!; wait $pid; sync

(grep "useradd[${pid}]" ${authlog} | tail -n 2) >> ${logfile}



Then I simply verify whether the user exists and continue accordingly.

This will execute useradd in the background, which is necessary so that $! will show me the PID of that particular process. It will then search /var/log/secure for the process ID in reverse order and write the output to my own logfile. A sync or pause (sleep 3) is necessary, but it should not hurt performance.