I need to see who has logged into a system via SSH, from which IP and when.

The system is Ubuntu 10.04 LTS , so there is no /var/log/secure

How can this be done?


check in /var/log/auth.log
There is no /var/log/secure in Ubuntu -- afaik (that was RedHat?).

Also, remember log rotation (so, lookup the auth.log.N.gz files too).

more ref.

  1. LinuxLogFiles at Ubuntu Help pages describe auth.log -- has a lot more details
  2. 20 Linux Log Files that are Located under /var/log Directory.

The command "last" will show you login history.


Check out lastlog :

petrus@host:~$ lastlog 
Utilisateur      Port     Venant de        Dernière
root                                       **Jamais connecté**
daemon                                     **Jamais connecté**
bin                                        **Jamais connecté**
sys                                        **Jamais connecté**
petrus           pts/0    2a01:e34:ee8c:18 dim. juin 17 20:06:14 +0200 2012
  • Sorry, system is in french, but it says: "User", "From", and "Last login". "Jamais connecté" means "never logged in". – petrus Jun 17 '12 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.