I would like to detect every login on my server. Not only ssh logins (virtual terminals) but also physical logins.

There is a way to use nagios or a script to watch log files. But I would like to know is there a way to catch that information one step before.

I thought about watching /dev/pts for changes but that is not different than log watching and everything does not appear in /dev/pts like a ssh tunnel (ssh -N user@server). These are only visible in logs because ssh tunnels do not open terminals.

But I would like to be able to catch these on login. Any ideas?

Thanks

p.s.: it is Debian 6.0 stable but that should not matter

Hi there,

If you are looking for heavy accounting and analysis utility then check out the following links:

http://www.cyberciti.biz/faq/list-co...n-linuxserver/

http://www.cyberciti.biz/tips/howto-...ccounting.html

your links are broken

What I recommend is to tail the /var/log/messages or /var/log/auth.log and grep it to specify what type of service to output. For example:

tail -f /var/log/messages | grep sshd

Sorry:

Here are they:

http://www.cyberciti.biz/faq/list-co...n-linuxserver/

http://www.cyberciti.biz/tips/howto-...ccounting.html

I know about that but grepping, parsing etc log files cannot be the only or best way to detect something like this. At least I hope so.

Well, there's always a thousand different ways to get the result but most Unix admin tasks can be accomplished with the core bash utilities such as grep, awk, sed and basic commands. It is really amazing what you can do as an admin for your own tasks. Mastering the core utilities takes some time but it is really a thing of wonder once you learn it. And that's just the tip of the iceberg compared to creating your own CGI admin interfaces or even custom programs written in C. The sky is the limit.

1 members found this post helpful.

Sounds like you want a PAM module that log or run a named cmd so you can have it done in 'real time' / instantly. This is one I found http://linux.die.net/man/8/pam_exec. There may be others.

1 members found this post helpful.

Sorry for a late response. Thanks, pam_exec is what I was looking for. Great.