Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to find out the list of users who logged into a Linux EC2 instance (e.g IP, time ..) for audit purposes.

share|improve this question

closed as not a real question by Chopper3, Jacob, ewwhite, Khaled, MDMarra May 13 '12 at 18:30

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

You wouldn't happen to know what operating system this is, would you? – EEAA May 11 '12 at 15:52
Could you provide some more details to your question about what your requirements are? Do you want historical logon info? Only active connections? etc. – jscott May 11 '12 at 15:52
Looks like this is on its way to being closed due to lack of information. I'd suggest editing your question to include more info on the operating system(s) involved. If the question has already been closed by that point, you can flag it and request that it be re-opened. – EEAA May 11 '12 at 16:02
historical info not necessarily active connections – priya May 11 '12 at 17:42
@ErikA - I had mentioned that this was for a Linux instance, wasn't that clear to you? Its just weird that someone would mark this as closed :( – priya May 13 '12 at 5:05
up vote 3 down vote accepted

Assuming this is a linux instance, the w shell commmand will show users that are currently logged in.

To see the last time someone logged in, use the lastlog command.

If you want a full accounting of all user logins, you'll need to grep through /var/log/auth.log.

share|improve this answer

Try last

Also, man last, man whois, man who

This all assumes you're talking about UNIX interactive logons at the OS level. If you're talking about anything else (like application logons, management console logons, you'll need to be more specific).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.