Shulou(Shulou.com)06/01 Report--

This article introduces the knowledge of "how to view login logs in Linux". In the operation of actual cases, many people will encounter such a dilemma, so let the editor lead you to learn how to deal with these situations. I hope you can read it carefully and be able to achieve something!

First, view the log file Linux view / var/log/wtmp file to view suspicious IP login

Last-f / var/log/wtmp

The log file permanently records the events of login, logout, startup and downtime of each user. Therefore, as the uptime of the system increases, the size of the file will become larger and larger.

The rate of increase depends on the number of times the system user logs in. The log file can be used to view the user's login record

The last command obtains this information by accessing the file and displays the user's login records in reverse order, and last can also display the corresponding records based on the user, terminal tty, or time.

Check / var/log/secure file to find suspicious IP login times

Second, the script generates the operation history of all logged-in users in the environment of the linux system, whether root users or other users can only log in to the system after entering the operation, we can use the command history to view the history, but if a server is logged in by more than one person, one day because someone misoperated and deleted important data. At this point, it doesn't make sense to check the history (command: history) (because history is only valid for logged-in users, even root users can't get other users' histotry history). Is there any way to record the history of the login IP address and a user name? Answer: yes.

This can be achieved by adding the following code to / etc/profile:

PS1= "`whoami` @ `hostname`:"'[$PWD] 'USER_IP= `who-u ami 2 > / dev/null | awk' {print $NF}'| sed-e's / [()] / / g``if ["$USER_IP" = ""] then USER_IP= `hostname` fi if [!-d / tmp/dbasky] then mkdir / tmp/dbasky chmod 777 / tmp/dbasky fi if [!-d / tmp/dbasky/$ {LOGNAME}] then mkdir / tmp/dbasky/$ {LOGNAME} chmod / tmp/dbasky/$ {LOGNAME} fi export HISTSIZE=4096 DT= `date "+% Y-%m-%d_%H:%M:%S" `export HISTFILE= "/ tmp/dbasky/$ {LOGNAME} / ${USER_IP}-dbasky.$DT" chmod 600 / tmp/dbasky/$ {LOGNAME} / * dbasky* 2 > / dev/null display details

Source / etc/profile use script to take effect

Log out of the user and log in again

? The face script creates a new dbasky directory in the / tmp of the system, recording all users who have logged in to the system and the IP address (file name). Every time the user logs in / out, the corresponding file will be created, which saves the operation history of the user during the login period. This method can be used to monitor the security of the system.

Root@zsc6: [/ tmp/dbasky/root] ls 10.1.80.47 dbasky.2013-10-24-12 root@zsc6 53-08 root@zsc6: [/ tmp/dbasky/root] cat 10.1.80.47 dbasky.2013-10-24-10-24-12-12-12-24-12 dbasky.2013-10.1.80.47 how to check the login log is here. Thank you for your reading. If you want to know more about the industry, you can follow the website, the editor will output more high-quality practical articles for you!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.