How to view the logons using the shipped logs

linuxfia · 02-09-2009, 08:11 PM

I have setup the Linux servers (Ubuntu Getsy) to ship the syslogs to the central location. On the actual Linux servers themselves, I can do "last" to view the logons. Is there a way to view this using the logs that were shipped? Below is my current syslog.conf file on the servers:

Code:

auth,authpriv.*                 /var/log/auth.log
auth,authpriv.*                 @loghost
*.*;auth,authpriv.none          -/var/log/syslog
cron.*                          /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log


mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err


news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice


*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          -/var/log/messages

*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     @loghost
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          @loghost


*.emerg                         *

daemon.*;mail.*;\
        news.err;\
        *.=debug;*.=info;\
        *.=notice;*.=warn       |/dev/xconsole

acid_kewpie · 02-10-2009, 02:53 AM

not directly, no, you'd need to look in the log files yourself, messages, auth.log and secure.

linuxfia · 02-11-2009, 05:32 PM

Okay, thanks.