cancel
Showing results for 
Search instead for 
Did you mean: 

Root or Admin login activity (history)

Mark_Ingle_1191
Nimbostratus
Nimbostratus

Is there a way to review when root or admin account is access? I am basically looking for a login history...Thanks!

 

2 REPLIES 2

nitass
F5 Employee
F5 Employee
is /var/log/secure usable?

 

 

gui Feb 27 12:32:22 ve11a notice httpd[7951]: 01070417:5: AUDIT - user admin - RAW: httpd(mod_auth_pam): user=admin(admin) partition=[All] level=Administrator tty=/sbin/nologin host=172.18.205.81 attempts=1 start="Wed Feb 27 08:55:19 2013" end="Wed Feb 27 12:32:22 2013". ssh Feb 27 12:33:14 ve11a info sshd(pam_audit)[28141]: user=root(root) partition=[All] level=Administrator tty=ssh host=192.168.206.75 attempts=1 start="Wed Feb 27 12:33:14 2013".

What_Lies_Bene1
Cirrostratus
Cirrostratus
For something a bit quicker (and less detailed) there is also the Linux command 'last'.