On Microsoft Windows NT, at system startup the event number 4608 is generated by Microsoft-Windows-Security-Auditing and I can see that in the security event log. You can read more about it in this TechNet article if you've not come across this.

As the TechNet article says, Windows system administrators can use this to track when the system starts up, because this event is a fairly early and fundamental user-space subsystem starting up. There are a whole bunch of security auditing events that are logged, in fact.

I'm looking for the equivalent on Unix. Is there some sort of security event log, as on Windows, which I can scan for a specific (to use Windows NT terminology because I don't yet know enough to know even the right names of what I want) "device process name" or "Device Event Class ID"? If so, where is it and what do I look for?

Otherwise, how can I find out the same information about when the server started up, shut down, people failed to log in, and so forth? All of the same sorts of things that I'd find from looking for security auditing events in the Microsoft Windows NT system event log.

Further reading

  • 2
    What are you looking for exactly? Are you trying to find out when the system got rebooted? – Julie Pelletier Aug 15 '16 at 16:30
  • I am using SIEM tool for security infra monitoring..Here i have more than 10 millions logs from UNIX systems..I need some sample logs for UNIX restart(shut down/ starting up (like in windows its 4608 and 4609)) which is impractical by checking each and every individual logs. So i can do it either by "device event category" or Device "Process Name" which is unique for each alert – Azmi Abid Aug 16 '16 at 21:44

I'm not familiar with Windows but from your descriptions the logs are structured rather differently.

On Linux, log messages don't have a formal structure; in the end, they're stored as a sequence of lines. Each line does indicate the time and the name of the originating process, but there's no formal codification like “event 4608”. The system startup generates a lot of log messages and analyzing log messages consists of looking for lines containing known patterns. You don't look for a “device process name” (I have no idea what that could mean), you look for a string, with grep or with more sophisticated log parsing tools.

Logs are stored in the directory /var/log. There are typically several log files; the way the log messages are dispatched to different files depends on the system configuration and different distributions have different defaults. Some messages may be recorded in more than one file.

A typical boot generates hundreds of entries in the kernel logs. These are typically in /var/log/kern.log but may be in another file in some distributions. One of the first messages starts with

Aug 16 16:51:40 darkstar kernel: Linux version 

(followed by the exact kernel version). This tells you when the computer booted, in the timezone of the process that records the logs.

For a system start event, there's another place where the information is easier to extract. There's a binary file that records current user login sessions (/var/log/utmp) and there's another file /var/log/wtmp that records past sessions. The historical record also records system reboots. Run last to see this historical information. To see only restart events, look for entries where the user name is reboot:

last | awk '$1 == "reboot"'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.