Help answer threads with 0 replies.
Go Back > Forums > Linux Forums > Linux - Newbie
User Name
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!


  Search this Thread
Old 02-17-2017, 03:48 PM   #1
Registered: Nov 2015
Posts: 397

Rep: Reputation: Disabled
Monitoring login and su messages using journalctl

Monitoring login log messages using journalctl

I know I can monitor login message like so:
[root@server1 log]# tail -f -n 3 /var/log/secure
Feb 17 07:17:40 server1 unix_chkpwd[4877]: 
password check failed for user (lisa)

Feb 17 07:17:40 server1 su: pam_unix(su-l:auth): 
authentication failure; logname=user1 uid=1000 
euid=0 tty=pts/2 ruser=user1 rhost=  user=lisa

Feb 17 07:17:43 server1 su: pam_ldap(su-l:auth): 
error reading from nslcd: Connection reset by peer
For above result, I purposely failed login for user lisa using this command:
su - lisa
So I thought I try using journalctl to follow login log messages:
[root@server1 log]# journalctl -f -n 3 _SYSTEMD_UNIT=systemd-logind.service 
-- Logs begin at Fri 2017-02-17 04:53:07 MST. --
Feb 17 04:55:32 systemd-logind[701]: New session 2 of user root.
Feb 17 06:12:24 systemd-logind[701]: New session 13 of user root.
Feb 17 06:43:57 systemd-logind[701]: New session 17 of user user1.
BUT it does not work for su command.
What is the fix to using journalctl for viewing login events like su command?
Thank you.

Last edited by fanoflq; 02-17-2017 at 04:04 PM.
Old 02-17-2017, 07:28 PM   #2
Registered: Feb 2006
Distribution: Debian Sid
Posts: 792

Rep: Reputation: 331Reputation: 331Reputation: 331Reputation: 331
This works on my machine:
$ journalctl -f -n3 -t su
From the journalctl man page:
-t, --identifier=SYSLOG_IDENTIFIER
Show messages for the specified syslog identifier SYSLOG_IDENTIFIER.
To see all of the fields execute:
$ journalctl -o verbose
From the man page:
-o, --output=
Controls the formatting of the journal entries that are shown. Takes one of the
following options:
shows the full-structured entry items with all fields.
1 members found this post helpful.
Old 02-17-2017, 08:01 PM   #3
Registered: Nov 2015
Posts: 397

Original Poster
Rep: Reputation: Disabled
Thank you.

I am adding this for future reference.
Show messages for the specified syslog identifier
SYSLOG_IDENTIFIER, or for any of the messages
with a "SYSLOG_IDENTIFIER" matched by PATTERN.
Where can I find definitions of SYSLOG_IDENTIFIER?

man systemd.journal-fields
Syslog compatibility fields containing
the facility (formatted as decimal string),
the identifier string (i.e. "tag"),
and the client PID. (Note that the
tag is usually derived from glibc's
program_invocation_short_name variable,
see program_invocation_short_name(3).)
... ....
which leads to this ....

man program_invocation_short_name
program_invocation_name contains the
name that was used to invoke the calling
program. This is the same as the value
of argv[0] in main(), with the difference
that the scope of program_invocation_name is global.

program_invocation_short_name contains
the basename component of name that was
used to invoke the calling program.
That is, it is the same value as
program_invocation_name, with all
text up to and including the final
slash (/), if any, removed.
..... .....

Last edited by fanoflq; 02-17-2017 at 08:17 PM.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
How to setup system Login banner and Login message 06-03-05 Linux - Newbie 13 07-24-2020 02:05 PM
[SOLVED] Can's see ISC DHCPD leases in journalctl now I moved to Fedora 22 big_sigh Linux - Server 1 06-09-2015 04:54 PM
Login times out while writing long message and then still can't submit message homerun LQ Suggestions & Feedback 6 08-19-2009 10:16 AM
X server message monitoring, how? ljubak Linux - Software 1 05-01-2007 10:11 AM
Jabber Message Monitoring kemplej Linux - Software 0 06-09-2005 03:06 PM > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 11:27 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration