Thursday, July 16, 2009

How to monitor users’ logins for a linux server ?

We can monitor user logins using command line tools last, lastb and lastlog .

last and lastb commands disply a record of when users last logged in to the host and a record of bad user logins.

last command without any options will print a report of the last logins to the host. last records also contains reboot entries

The lastb command produces the same style of report but lists only those logins that were "bad". In other words, it lists those logins in which an incorrect password was entered, or some other error resulted in failure to login.

The lastlog command displays a report that shows the login status of all users on your host, including those users who have never logged in.

you can use grep to filter required output

# lastlog | grep -v ' **Never logged in**'

read man pages for more details.

No comments: