Forum Discussion

Mark_Ingle_1191's avatar
Mark_Ingle_1191
Icon for Nimbostratus rankNimbostratus
Feb 26, 2013

Root or Admin login activity (history)

Is there a way to review when root or admin account is access? I am basically looking for a login history...Thanks!

 

2 Replies

  • is /var/log/secure usable?

     gui
    Feb 27 12:32:22 ve11a notice httpd[7951]: 01070417:5: AUDIT - user admin - RAW: httpd(mod_auth_pam): user=admin(admin) partition=[All] level=Administrator tty=/sbin/nologin host=172.18.205.81 attempts=1 start="Wed Feb 27 08:55:19 2013" end="Wed Feb 27 12:32:22 2013".
    
     ssh
    Feb 27 12:33:14 ve11a info sshd(pam_audit)[28141]: user=root(root) partition=[All] level=Administrator tty=ssh host=192.168.206.75 attempts=1 start="Wed Feb 27 12:33:14 2013".
    
    
  • For something a bit quicker (and less detailed) there is also the Linux command 'last'.