Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to find programmatically from a log file that user logs in to a Debian machine. I also want to see who logs in and what ever is logged to the file on that time. How to accomplish that task on Debian machine version 4.1 or 5?

If the information is not present in any file, is there another way of catching these events and getting the event details programmatically?

share|improve this question
Did you seen on linux logs? – Diogo Jun 13 '11 at 13:27
up vote 0 down vote accepted

The file /var/run/utmp has information in who's logged in, what tty they're using, how long they've been idle, and more. Watching this file (there being a C API for this (/usr/include/utmp.h)).

Also, /var/log/wtmp (if I understand the man pages correctly), is the list of users who were logged in.

share|improve this answer

The last command is the command-line approach. See man last for the options.

It searches through /var/log/wtmp for login details.

You may be able to do so programmatically.

share|improve this answer
Thanks for the quick answer. It hit directly on the right point and I'll accept the answer immediately :) – mico Jun 13 '11 at 13:36
sorry I found another, even more suitable one :( I would give you a vote still, if I had rights :) – mico Jun 13 '11 at 13:45
well... someone did, so I'm still ahead of where I was yesterday. – pavium Jun 13 '11 at 13:52

look into /var/log/auth.log authentication session events are logged there. You need root privileges to access that file.

share|improve this answer

On Linux, there is no single "login" event - each program may implement it in its own way. The closest is PAM ... for applications that use PAM. Most of them do, but for example, SSH only calls pam_authenticate() if you log in using a password, but not when public keys or Kerberos are used, although pam_open_session() is always called.

If you only need to log interactive sessions (SSH, console), then watch /var/log/wtmp (using inotify). See the manual page of wtmp for description of the exact structure.

For mail, [S]FTP, other protocols, you will have to use /var/log/auth.log, which unfortunately doesn't have a consistent format.

  • Three different examples from auth.log:

    • SSH with password – both "sshd:auth" and "sshd:session" are listed

      sshd[24870]: pam_krb5(sshd:auth): user grawity authenticated as grawity@REALM
      sshd[24870]: Accepted password for grawity from ::1 port 57063 ssh2
      sshd[24870]: pam_unix(sshd:session): session opened for user grawity by (uid=0)

    • IMAP – "mail:auth" but no "mail:session"

      auth [0 wait, 0 passdb, 0 userdb]: pam_krb5(mail:auth): user grawity authenticated as grawity@REALM

    • SSH with public key – only "sshd:session" but no "sshd:auth"

      sshd[24985]: Accepted publickey for grawity from ::1 port 51606 ssh2
      sshd[24985]: pam_unix(sshd:session): session opened for user grawity by (uid=0)

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .