Welcome to the most active Linux Forum on the web.
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 07-31-2003, 11:29 AM   #1
Registered: Jul 2003
Location: Louisville aka Derby City
Distribution: WinXP SP2 and SP3, W2K Server, Ubuntu
Posts: 313

Rep: Reputation: 30
Question Users "logging in" log file


Could someone tell me if there is a file that REDHAT stores log in information in. I was looking for a log that would record each time someone logged in or out and what time,data,etc that event occured on.

Also, what should I be looking for in other files if I suspect someone is messing around? What are the key log files to watch and what would I be looking for?

Is there a log file that records where a user logs in from? Like what IP address for instance?

Is there a log file that monitors IP connections? This would be like a connection from another computer but not neccesarily a user logging into a shell. For example, if my computer was pinged or samba was accessed, etc.
Old 07-31-2003, 11:50 AM   #2
Senior Member
Registered: Feb 2002
Location: harvard, il
Distribution: Ubuntu 11.4,DD-WRT micro plus ssh,lfs-6.6,Fedora 15,Fedora 16
Posts: 3,199

Rep: Reputation: 397Reputation: 397Reputation: 397Reputation: 397
sure, /etc/wtmp, it can be accessed by the 'last' command
Old 07-31-2003, 11:53 AM   #3
Registered: Jul 2003
Location: Clinging to my guns and religion.
Posts: 683

Rep: Reputation: 63
you ever used the last command?

/var/log/messages might give you some information also...


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
New SQUID user: How to clear the "access.log" and "store.log" automatically? yuzuohong Linux - Networking 2 12-02-2006 06:37 AM
"users.allow" and "users.deny": under what directory, in Mandriva? KWTm Mandriva 0 10-09-2005 03:23 PM
What does "SFW2-INext-DROP-DEFLT" in my messages log file mean? TrulyTessa Linux - Networking 11 12-22-2004 10:28 AM
"adduser" not adding users to default group "users" PunkPT Slackware 2 09-23-2004 12:50 PM
"rwx" and "valid users" - which one has precedence? kenji1903 Linux - Networking 8 07-27-2004 11:21 AM

All times are GMT -5. The time now is 05:51 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration