Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using a server running the Debian operating system. Is there a way i can check who logged in to the server, i mean the past logins . I would like to do this to monitor the security on the server. Is this information stored somewhere ?

Thank You

share|improve this question
add comment

4 Answers

The /var/log/utmp and /var/log/wtmp files store details of logins and logouts. They are described in the utmp man page.

You can use the last command (in the Debian sysvinit-utils package) to display the logins:

# last
me       pts/0        hostname1        Mon Dec 14 15:03   still logged in
someone  pts/0        hostname2        Mon Dec 14 11:12 - 12:20  (01:08)

wtmp begins Tue Dec  1 15:18:32 2009
share|improve this answer
add comment

User logins are stored in /var/log/auth.log by default on debian systems

share|improve this answer
add comment

/var/log/auth.log contains authentication information, including logins. Try 'cat /var/log/auth.log | grep ssh' for SSH logins.

share|improve this answer
add comment

Use the "last" command, which shows a list of the last logged in users:

last | head -n 10

man last
for more information :)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.