Hello people of the stackexchange,
I am having a little difficulty trying to find a location of a particular log file which i'm hoping someone on here could help me with.
What i am trying to do is list the login dates/times for a particular user on our sftp server. From researching online i have so far come up
cat /var/log/auth.log | grep "username"
which has listed some of the logins but not as far back as i am looking for.
I have also tried
last -n 1000 | grep "username"
but unfortunately this only seems to work for ssh access to the server rather than sftp (as far as i am aware)
Can anyone think of any other methods of listing the logins from a particular user of an sftp user?
many thanks in advance, daark. N.B. the user is chrooted to their own home directory if that helps in any way.
I didn't notice some of the archive files in the first instance, these gave me up to one month worth of logins which is better. New question: By default how long does CentOs hold onto the archived auth logs? If it is more than one month where do the older archives move to?
I have checked the logrotate.conf and there is no mention of
/var/log/auth.log so i'm assuming it is using default values.
Edit:Edit I think I may have found the answer I was looking for but posting this anyway just in case it is of any use to some one else.
The logrotate script is
/etc/logrotate.d/rsyslog. By default these rotate weekly and store up to 4 weeks worth of logs.
I do not yet have the reputation to put this as an answer but if an admin see's this please feel free to close it.
Best wishes ~ daark