LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 03-19-2009, 05:17 AM   #1
vaaub
LQ Newbie
 
Registered: Feb 2004
Posts: 7

Rep: Reputation: 0
where I can find the user login record


Hi,all!

I want to know how I can find the user login record if the /var/log/wtmp is deleted. What I want to know is who log into the system and the user's ip if he is using putty to access remotely.

Thanks a lot!
 
Old 03-19-2009, 11:25 AM   #2
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 18,343

Rep: Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905
Quote:
Originally Posted by vaaub View Post
Hi,all!

I want to know how I can find the user login record if the /var/log/wtmp is deleted. What I want to know is who log into the system and the user's ip if he is using putty to access remotely.

Thanks a lot!
You won't be able to tell what terminal emulator he's using remotely, no matter what, only what port they connect to, such as SSH or telnet.

If wtmp is gone, your only other option is to look at the system logs, and see if login messages are getting saved there.
 
Old 03-19-2009, 11:32 AM   #3
vaaub
LQ Newbie
 
Registered: Feb 2004
Posts: 7

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by TB0ne View Post
You won't be able to tell what terminal emulator he's using remotely, no matter what, only what port they connect to, such as SSH or telnet.

If wtmp is gone, your only other option is to look at the system logs, and see if login messages are getting saved there.
which ones are the system logs?
 
Old 03-19-2009, 02:38 PM   #4
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 18,343

Rep: Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905Reputation: 3905
Quote:
Originally Posted by vaaub View Post
which ones are the system logs?
That depends on how you have your system set up, but normally it's /var/log/messages.
 
Old 03-19-2009, 07:35 PM   #5
JaksoDebr
Member
 
Registered: Mar 2009
Distribution: Fedora, Slackware
Posts: 104

Rep: Reputation: 21
/var/log/lastlog file stores user last login information. This is binary file. You need to use lastlog command to format and print the contents of the /var/log/lastlog file.

Use the lastlog command to display users and their last login info.

If the user has never logged in the message "**Never logged in**" will be displayed instead of the port and time.

See also http://www.cyberciti.biz/faq/howto-d...n-information/ for more complete information.

Linux Archive

Last edited by JaksoDebr; 04-02-2009 at 06:18 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Last login record juno Linux - General 3 07-23-2010 07:59 AM
NIS client login "cannot find user name for user ID" danielbourne Linux - Networking 2 08-24-2006 05:16 AM
where to find .profile or .login for a specific user bopedibop Linux - Newbie 2 07-11-2006 11:23 AM
How we can record the login failures? mahabooba Linux - Security 7 02-08-2006 05:59 AM
how i find record input New 2 The Game Linux - Software 1 09-08-2003 05:25 AM


All times are GMT -5. The time now is 03:16 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration