Share your knowledge at the LQ Wiki.
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 07-31-2003, 10:29 AM   #1
Registered: Jul 2003
Location: Louisville aka Derby City
Distribution: WinXP SP2 and SP3, W2K Server, Ubuntu
Posts: 313

Rep: Reputation: 30
Question Users "logging in" log file


Could someone tell me if there is a file that REDHAT stores log in information in. I was looking for a log that would record each time someone logged in or out and what time,data,etc that event occured on.

Also, what should I be looking for in other files if I suspect someone is messing around? What are the key log files to watch and what would I be looking for?

Is there a log file that records where a user logs in from? Like what IP address for instance?

Is there a log file that monitors IP connections? This would be like a connection from another computer but not neccesarily a user logging into a shell. For example, if my computer was pinged or samba was accessed, etc.
Old 07-31-2003, 10:50 AM   #2
Senior Member
Registered: Feb 2002
Location: harvard, il
Distribution: Ubuntu 11.4,DD-WRT micro plus ssh,lfs-6.6,Fedora 15,Fedora 16
Posts: 3,225

Rep: Reputation: 402Reputation: 402Reputation: 402Reputation: 402Reputation: 402
sure, /etc/wtmp, it can be accessed by the 'last' command
Old 07-31-2003, 10:53 AM   #3
Registered: Jul 2003
Location: Clinging to my guns and religion.
Posts: 683

Rep: Reputation: 63
you ever used the last command?

/var/log/messages might give you some information also...


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
New SQUID user: How to clear the "access.log" and "store.log" automatically? yuzuohong Linux - Networking 2 12-02-2006 05:37 AM
"users.allow" and "users.deny": under what directory, in Mandriva? KWTm Mandriva 0 10-09-2005 02:23 PM
What does "SFW2-INext-DROP-DEFLT" in my messages log file mean? TrulyTessa Linux - Networking 11 12-22-2004 09:28 AM
"adduser" not adding users to default group "users" PunkPT Slackware 2 09-23-2004 11:50 AM
"rwx" and "valid users" - which one has precedence? kenji1903 Linux - Networking 8 07-27-2004 10:21 AM > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 04:15 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration