Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to see who has logged into a system via SSH, from which IP and when.

The system is Ubuntu 10.04 LTS , so there is no /var/log/secure

How can this be done?

share|improve this question
up vote 4 down vote accepted

check in /var/log/auth.log
There is no /var/log/secure in Ubuntu -- afaik (that was RedHat?).

Also, remember log rotation (so, lookup the auth.log.N.gz files too).

more ref.

  1. LinuxLogFiles at Ubuntu Help pages describe auth.log -- has a lot more details
  2. 20 Linux Log Files that are Located under /var/log Directory.
share|improve this answer

The command "last" will show you login history.

share|improve this answer

Check out lastlog :

petrus@host:~$ lastlog 
Utilisateur      Port     Venant de        Dernière
root                                       **Jamais connecté**
daemon                                     **Jamais connecté**
bin                                        **Jamais connecté**
sys                                        **Jamais connecté**
petrus           pts/0    2a01:e34:ee8c:18 dim. juin 17 20:06:14 +0200 2012
share|improve this answer
Sorry, system is in french, but it says: "User", "From", and "Last login". "Jamais connecté" means "never logged in". – petrus Jun 17 '12 at 18:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.