up vote 0 down vote favorite
share [g+] share [fb]

I have a question. How can I check a user who did access to the Server let say 2-3 days before? I am trying to investigate on who was the person who has gained access to the particular server via remote. Can I catch the IP Address who did access to the server as well? Thanks.

link|improve this question
2  
via remote what? as in via regular Linux means (SSH for instance) or via the iLO hardware? there's a huge difference, and if it's via linux means then please edit the hardware model out of the question as it's wouldn't be relevant at that point. – Chopper3 Apr 4 '11 at 10:30
feedback

2 Answers

up vote 1 down vote

The last command might prove helpful. It displays a list of users logged in since /var/log/wtmp was created.

link|improve this answer
feedback
up vote 1 down vote

You should be able to get what you want from:

lastlog -u user -b 2

Cheers

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.