How to see the login event programmatically?

Question

I want to find programmatically from a log file that user logs in to a Debian machine. I also want to see who logs in and what ever is logged to the file on that time. How to accomplish that task on Debian machine version 4.1 or 5?

If the information is not present in any file, is there another way of catching these events and getting the event details programmatically?

Answer 1

The file /var/run/utmp has information in who's logged in, what tty they're using, how long they've been idle, and more. Watching this file (there being a C API for this (/usr/include/utmp.h)).

Also, /var/log/wtmp (if I understand the man pages correctly), is the list of users who were logged in.

Answer 2

The last command is the command-line approach. See man last for the options.

It searches through /var/log/wtmp for login details.

You may be able to do so programmatically.

Answer 3

look into /var/log/auth.log authentication session events are logged there. You need root privileges to access that file.

Answer 4

On Linux, there is no single "login" event - each program may implement it in its own way. The closest is PAM ... for applications that use PAM. Most of them do, but for example, SSH only calls pam_authenticate() if you log in using a password, but not when public keys or Kerberos are used, although pam_open_session() is always called.

If you only need to log interactive sessions (SSH, console), then watch /var/log/wtmp (using inotify). See the manual page of wtmp for description of the exact structure.

For mail, [S]FTP, other protocols, you will have to use /var/log/auth.log, which unfortunately doesn't have a consistent format.

• Three different examples from auth.log:

  • SSH with password – both "sshd:auth" and "sshd:session" are listed

    sshd[24870]: pam_krb5(sshd:auth): user grawity authenticated as grawity@REALM
    sshd[24870]: Accepted password for grawity from ::1 port 57063 ssh2
    sshd[24870]: pam_unix(sshd:session): session opened for user grawity by (uid=0)

  • IMAP – "mail:auth" but no "mail:session"

    auth [0 wait, 0 passdb, 0 userdb]: pam_krb5(mail:auth): user grawity authenticated as grawity@REALM

  • SSH with public key – only "sshd:session" but no "sshd:auth"

    sshd[24985]: Accepted publickey for grawity from ::1 port 51606 ssh2
    sshd[24985]: pam_unix(sshd:session): session opened for user grawity by (uid=0)