Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using Ubuntu. Is there a good system that can do this?

share|improve this question
Surprised about the negative modding. Seems like a fair question, albeit one that might deserve a RTFM answer. – BuildTheRobots Jan 14 '10 at 21:50
RTFM answers are discouraged. But it's hard to tell what the OP is looking for anyway. – womble Jan 14 '10 at 22:32
up vote 7 down vote accepted

if you mean people connecting via ssh, then try sudo last.

You could use something like LogWatch to email you updates.

share|improve this answer
We use LogWatch to sends us an email of all IP addresses that attempt to ssh to the machine. The analysis of said logs has recently caused us to move all our ssh to a non-standard port just to stop the random crack attempts, even though they were never successful. – Catherine MacInnes Jan 14 '10 at 21:01
@Catherine MacInnes: fail2ban is a lovely little program that will watch your logs for brute force attempts and then tell iptables to block the connection. Should be what you're looking for (although a non standard port does cut out 99% of none targeted attacks) – BuildTheRobots Jan 14 '10 at 21:52

What services do you want to monitor?

Most services already have logging capabilities. If you want to monitor some services that lacks a logging facility then you can add an iptables rule that will log any connection attempt to your system.

# Log syn packets
iptables --append INPUT --proto tcp --dport 0:65535 --syn --jump LOG \
         --log-level 6 --log-prefix "IPTBLS TCP-LOCAL: "
share|improve this answer

looking at the "/var/log/messages" and all other log file frequently considered a good habit those who sits on open system.So start doing it from now... you never know when you get compromised :)

share|improve this answer

The following will show you ssh logins and attempted logins:

sudo cat /var/log/auth.log | grep 'sshd'

Though as Catherine MacInnes suggested, using logwatch makes life easier.

share|improve this answer

If you mean when people ssh into your machine, you can find that information in the /var/log/auth.log file

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.