Forum Discussion

Mark_Ingle_1191's avatar
Mark_Ingle_1191
Icon for Nimbostratus rankNimbostratus
Feb 26, 2013

Root or Admin login activity (history)

Is there a way to review when root or admin account is access? I am basically looking for a login history...Thanks!  
management
monitoring
nitass's avatar
nitass
Icon for Employee rankEmployee
Feb 27, 2013
is /var/log/secure usable? 

 gui
Feb 27 12:32:22 ve11a notice httpd[7951]: 01070417:5: AUDIT - user admin - RAW: httpd(mod_auth_pam): user=admin(admin) partition=[All] level=Administrator tty=/sbin/nologin host=172.18.205.81 attempts=1 start="Wed Feb 27 08:55:19 2013" end="Wed Feb 27 12:32:22 2013".

 ssh
Feb 27 12:33:14 ve11a info sshd(pam_audit)[28141]: user=root(root) partition=[All] level=Administrator tty=ssh host=192.168.206.75 attempts=1 start="Wed Feb 27 12:33:14 2013".