I imagined command
last, would also give me mysql over ssh tunnels list. But I was wrong. Is there a place where this tunnels are logged?
Ubuntu server 12.04.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
last command will only show those ssh sessions that actually included a shell started at the remote end. Most tunnel sessions don't do that, which is why they're not counted there.
However, the authentication logs will still show the SSH connections. That will often be
/var/log/auth.log, but you may need to check your syslog setup to find the setup.
Another way to find out what is what would be to look at it from the other end. From MySQL's point of view, a connection made via an SSH tunnel will look just like a connection from localhost. So if you can see a connection from
userA at a time when
userA was not logged in to the machine, and the connection still is from localhost, then that would have been made through a tunnel.