17

I want to find out everything possible about how the PC was used in the past few days. Like who logged in, for how long was the PC was locked and any other information about user activity that is logged on the PC.

I know that last command can be used to find out who was logged in and for how long. Any other information that can be found out.

Improve this question

5 Answers 5

Reset to default
21

The last command will show user logins, logouts, system reboots and run level changes.

The lastlog command "reports the most recent login of all users".

The file /etc/syslog.conf will show how your log files are configured. For example, it may show that auth and authpriv.* facilities are logged to /var/log/auth.log. In other cases, such as Ubuntu, look at /etc/rsyslog.conf and the files in /etc/rsyslog.d for this information.

Your log files will probably be rotated, so in addition to looking at files such as /var/log/auth.log, you may need to look in their older counterparts such as /var/log/auth.log.1 and /var/log/auth.log.n.gz (using zcat) where "n" could be any integer depending on how your rotation is set up.

Although the files can be manipulated by the users, sometimes you can look at ones such as ~username/.bash_history. Even files like ~username/.lesshst can have useful information if you really need to dig deep.

Improve this answer
1
  • The last paragraph is useful, I used history -E or history -i and got the datetime stamp, not unixtime as in the .bash-history. Regarding .lesshst, there seem to be no .morehst. But more is still used.
    – Timo
    Commented Nov 21, 2020 at 19:00
3

an insteresting way to see all activity in one shot.

egrep -r '(login|attempt|auth|success):' /var/log

you can change keywords (login|attempt|auth|success) with suitable ones according to your linux box. to add more use long pipe in paranthesis.

Improve this answer
1
  • 1
    zgrep -e '(login|attempt|auth|success):' /var/log/* to handle gzipped files.
    – CivFan
    Commented Nov 30, 2018 at 20:53
2

Check out the syslog messages in /var/log/* there is alot of good info there about what has been going on on your system.

Improve this answer
0

Beside all great answers here, it might be useful to also check shell history of all users (if for example admin checks if some failure wasn't caused by one of them). This could be checked in files like .bash_history / .zsh_history / .python_history with command:

sudo find / -name ".*_history" | sudo xargs tail -n 100

Note: Those files could be easily tampered by users

Improve this answer
-1

Just add below line in /etc/rsyslog.conf:

local3.*     /var/log/user-activity.log
Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .