0

Is there a way to find out the list of users who logged into a Linux EC2 instance (e.g IP, time ..) for audit purposes.

5
  • 1
    You wouldn't happen to know what operating system this is, would you?
    – EEAA
    Commented May 11, 2012 at 15:52
  • 1
    Could you provide some more details to your question about what your requirements are? Do you want historical logon info? Only active connections? etc.
    – jscott
    Commented May 11, 2012 at 15:52
  • 1
    Looks like this is on its way to being closed due to lack of information. I'd suggest editing your question to include more info on the operating system(s) involved. If the question has already been closed by that point, you can flag it and request that it be re-opened.
    – EEAA
    Commented May 11, 2012 at 16:02
  • historical info not necessarily active connections
    – priya
    Commented May 11, 2012 at 17:42
  • @ErikA - I had mentioned that this was for a Linux instance, wasn't that clear to you? Its just weird that someone would mark this as closed :(
    – priya
    Commented May 13, 2012 at 5:05

2 Answers 2

5

Assuming this is a linux instance, the w shell commmand will show users that are currently logged in.

To see the last time someone logged in, use the lastlog command.

If you want a full accounting of all user logins, you'll need to grep through /var/log/auth.log.

2

Try last

Also, man last, man whois, man who

This all assumes you're talking about UNIX interactive logons at the OS level. If you're talking about anything else (like application logons, management console logons, you'll need to be more specific).

Not the answer you're looking for? Browse other questions tagged .