I all, I have a linux Server (Ubuntu) where some user can be connect to by ssh. Is possible to know who was connected to the server? A sort of list of login by ssh of the past day. Is possible to retrieve?


who will show you who is currently connected.
w will show you who is curretly connected, plus what command they're running.
last will show you all users logged in/out since /var/log/wtmp was last rolled.

The contents of /var/log/auth.log and/or /var/log/secure may also be useful, but the commands above will probably get you what you need to know

  • I don't want who is connect in that moment but who connected in last days. I'll see this file – Alessandro Minoccheri Feb 26 '13 at 17:11
  • I don't have /var/log/auth.log /var/log/wtmp and /var/log/secure no files.. :( – Alessandro Minoccheri Feb 26 '13 at 17:14

I don't know if this'll help but I came across the last command recently. It shows:

  • User name
  • Tty device number
  • Login date and time
  • Logout time
  • Total working time

For Example: Example

Also, If I'm not mistaken, remote login attempts are stored in the /var/log/secure logs as well.

Hope this Helps..

  • I don't have file or folder in var/log/secure. Secure isn't exist – Alessandro Minoccheri Feb 27 '13 at 7:24
  • Can you try the following --> grep -ir ssh /var/log/* and grep -ir security /var/log/* – rahuL Feb 28 '13 at 5:00
  • Nothing return to me – Alessandro Minoccheri Feb 28 '13 at 11:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.