LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 07-31-2003, 10:29 AM   #1
jdruin
Member
 
Registered: Jul 2003
Location: Louisville aka Derby City
Distribution: WinXP SP2 and SP3, W2K Server, Ubuntu
Posts: 313

Rep: Reputation: 30
Question Users "logging in" log file


Hello

Could someone tell me if there is a file that REDHAT stores log in information in. I was looking for a log that would record each time someone logged in or out and what time,data,etc that event occured on.

Also, what should I be looking for in other files if I suspect someone is messing around? What are the key log files to watch and what would I be looking for?

Is there a log file that records where a user logs in from? Like what IP address for instance?

Is there a log file that monitors IP connections? This would be like a connection from another computer but not neccesarily a user logging into a shell. For example, if my computer was pinged or samba was accessed, etc.
 
Old 07-31-2003, 10:50 AM   #2
frieza
Senior Member
 
Registered: Feb 2002
Location: harvard, il
Distribution: Ubuntu 11.4,DD-WRT micro plus ssh,lfs-6.6,Fedora 15,Fedora 16
Posts: 3,086

Rep: Reputation: 368Reputation: 368Reputation: 368Reputation: 368
sure, /etc/wtmp, it can be accessed by the 'last' command
 
Old 07-31-2003, 10:53 AM   #3
Blinker_Fluid
Member
 
Registered: Jul 2003
Location: Clinging to my guns and religion.
Posts: 682

Rep: Reputation: 63
you ever used the last command?

/var/log/messages might give you some information also...
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
New SQUID user: How to clear the "access.log" and "store.log" automatically? yuzuohong Linux - Networking 2 12-02-2006 05:37 AM
"users.allow" and "users.deny": under what directory, in Mandriva? KWTm Mandriva 0 10-09-2005 02:23 PM
What does "SFW2-INext-DROP-DEFLT" in my messages log file mean? TrulyTessa Linux - Networking 11 12-22-2004 09:28 AM
"adduser" not adding users to default group "users" PunkPT Slackware 2 09-23-2004 11:50 AM
"rwx" and "valid users" - which one has precedence? kenji1903 Linux - Networking 8 07-27-2004 10:21 AM


All times are GMT -5. The time now is 11:33 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration