2

I want to know the details of user logins of my Gnu/Linux servers (RHEL7 and Ubuntu 16.04) e.g. who, from what IP, when. So what is the location of the log files, from which I can find the list of the users and details of the last 30 days.

I also want to redirect these logs on another location (ftp://IP/logindetails). So please guide me, How can I make it possible?

  • What distro? The defaults vary. – jordanm Feb 17 '17 at 17:08
  • On RHEL 7 and Ubuntu both – Puneet Dixit Feb 17 '17 at 17:08
  • /var/log/auth.log on ubuntu, /var/log/secure on RHEL – jordanm Feb 17 '17 at 17:13
  • Thanks, Can I redirect these on another location like ftp site or shared drive – Puneet Dixit Feb 17 '17 at 19:02
  • Most people use the system's syslog daemon (the rsyslog or syslog-ng daemon) to send the logs to a remote system that is listening on the syslog port. It would be a lot easier than creating a whole new service to copy the data. – jsbillings Feb 18 '17 at 4:26
0

The logs themselves vary by distro but are usually found in /var/log/.

Examples /var/log/utmp, /var/log/btmp, /var/log/wtmp /var/log/secure

Among those, utmp shows system information and status as well as terminal logins.

btmp shows failed logins. /var/log/faillog may have this as well

/var/log/auth shows PAM summaries, including authentication and login.

See utmp on Wikipedia for more information.

See AskUbuntu - How to See Login History?

For copying, you can use ftp to transfer the files, or you could directly copy them over using scp or rsync

-1

RHEL login details can be found in: /var/log/wtmp

Ubuntu login details can be found in: /var/log/auth.log

You could run a cron job to copy the logfile to your ftp server

crontab -e
0 0 * * * curl -T /var/log/<logfile> ftp://IP/logindetails --user user:secret

You just need to specify the logfile and user information for the cronjob. This would copy the logfile over every day at midnight.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.