LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 02-17-2017, 04:48 PM   #1
fanoflq
Member
 
Registered: Nov 2015
Posts: 397

Rep: Reputation: Disabled
Monitoring login and su messages using journalctl


Monitoring login log messages using journalctl

I know I can monitor login message like so:
Code:
[root@server1 log]# tail -f -n 3 /var/log/secure
Feb 17 07:17:40 server1 unix_chkpwd[4877]: 
password check failed for user (lisa)

Feb 17 07:17:40 server1 su: pam_unix(su-l:auth): 
authentication failure; logname=user1 uid=1000 
euid=0 tty=pts/2 ruser=user1 rhost=  user=lisa

Feb 17 07:17:43 server1 su: pam_ldap(su-l:auth): 
error reading from nslcd: Connection reset by peer
For above result, I purposely failed login for user lisa using this command:
Code:
su - lisa
So I thought I try using journalctl to follow login log messages:
Code:
[root@server1 log]# journalctl -f -n 3 _SYSTEMD_UNIT=systemd-logind.service 
-- Logs begin at Fri 2017-02-17 04:53:07 MST. --
Feb 17 04:55:32 server1.example.com systemd-logind[701]: New session 2 of user root.
Feb 17 06:12:24 server1.example.com systemd-logind[701]: New session 13 of user root.
Feb 17 06:43:57 server1.example.com systemd-logind[701]: New session 17 of user user1.
^C
BUT it does not work for su command.
What is the fix to using journalctl for viewing login events like su command?
Thank you.

Last edited by fanoflq; 02-17-2017 at 05:04 PM.
 
Old 02-17-2017, 08:28 PM   #2
norobro
Member
 
Registered: Feb 2006
Distribution: Debian Sid
Posts: 792

Rep: Reputation: 330Reputation: 330Reputation: 330Reputation: 330
This works on my machine:
Code:
$ journalctl -f -n3 -t su
From the journalctl man page:
Quote:
-t, --identifier=SYSLOG_IDENTIFIER
Show messages for the specified syslog identifier SYSLOG_IDENTIFIER.
To see all of the fields execute:
Code:
$ journalctl -o verbose
From the man page:
Quote:
-o, --output=
Controls the formatting of the journal entries that are shown. Takes one of the
following options:
...
verbose
shows the full-structured entry items with all fields.
...
 
1 members found this post helpful.
Old 02-17-2017, 09:01 PM   #3
fanoflq
Member
 
Registered: Nov 2015
Posts: 397

Original Poster
Rep: Reputation: Disabled
@norobro:
Thank you.

I am adding this for future reference.
Quote:
-t, --identifier=SYSLOG_IDENTIFIER|PATTERN
Show messages for the specified syslog identifier
SYSLOG_IDENTIFIER, or for any of the messages
with a "SYSLOG_IDENTIFIER" matched by PATTERN.
Where can I find definitions of SYSLOG_IDENTIFIER?

Quote:
man systemd.journal-fields
SYSLOG_FACILITY=, SYSLOG_IDENTIFIER=, SYSLOG_PID=
Syslog compatibility fields containing
the facility (formatted as decimal string),
the identifier string (i.e. "tag"),
and the client PID. (Note that the
tag is usually derived from glibc's
program_invocation_short_name variable,
see program_invocation_short_name(3).)
... ....
which leads to this ....

Quote:
man program_invocation_short_name
DESCRIPTION
program_invocation_name contains the
name that was used to invoke the calling
program. This is the same as the value
of argv[0] in main(), with the difference
that the scope of program_invocation_name is global.

program_invocation_short_name contains
the basename component of name that was
used to invoke the calling program.
That is, it is the same value as
program_invocation_name, with all
text up to and including the final
slash (/), if any, removed.
..... .....

Last edited by fanoflq; 02-17-2017 at 09:17 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to setup system Login banner and Login message 06-03-05 Linux - Newbie 11 08-26-2018 01:00 PM
[SOLVED] Can's see ISC DHCPD leases in journalctl now I moved to Fedora 22 big_sigh Linux - Server 1 06-09-2015 05:54 PM
Login times out while writing long message and then still can't submit message homerun LQ Suggestions & Feedback 6 08-19-2009 11:16 AM
X server message monitoring, how? ljubak Linux - Software 1 05-01-2007 11:11 AM
Jabber Message Monitoring kemplej Linux - Software 0 06-09-2005 04:06 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 08:44 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration