Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to find programmatically from a log file that user logs in to a Debian machine. I also want to see who logs in and what ever is logged to the file on that time. How to accomplish that task on Debian machine version 4.1 or 5?

If the information is not present in any file, is there another way of catching these events and getting the event details programmatically?

share|improve this question
    
Did you seen on linux logs? –  Diogo Jun 13 '11 at 13:27
add comment

4 Answers 4

up vote 0 down vote accepted

The file /var/run/utmp has information in who's logged in, what tty they're using, how long they've been idle, and more. Watching this file (there being a C API for this (/usr/include/utmp.h)).

Also, /var/log/wtmp (if I understand the man pages correctly), is the list of users who were logged in.

share|improve this answer
add comment

On Linux, there is no single "login" event - each program may implement it in its own way. The closest is PAM ... for applications that use PAM. Most of them do, but for example, SSH only calls pam_authenticate() if you log in using a password, but not when public keys or Kerberos are used, although pam_open_session() is always called.

If you only need to log interactive sessions (SSH, console), then watch /var/log/wtmp (using inotify). See the manual page of wtmp for description of the exact structure.

For mail, [S]FTP, other protocols, you will have to use /var/log/auth.log, which unfortunately doesn't have a consistent format.

  • Three different examples from auth.log:

    • SSH with password – both "sshd:auth" and "sshd:session" are listed

      sshd[24870]: pam_krb5(sshd:auth): user grawity authenticated as grawity@REALM
      sshd[24870]: Accepted password for grawity from ::1 port 57063 ssh2
      sshd[24870]: pam_unix(sshd:session): session opened for user grawity by (uid=0)

    • IMAP – "mail:auth" but no "mail:session"

      auth [0 wait, 0 passdb, 0 userdb]: pam_krb5(mail:auth): user grawity authenticated as grawity@REALM

    • SSH with public key – only "sshd:session" but no "sshd:auth"

      sshd[24985]: Accepted publickey for grawity from ::1 port 51606 ssh2
      sshd[24985]: pam_unix(sshd:session): session opened for user grawity by (uid=0)

share|improve this answer
add comment

look into /var/log/auth.log authentication session events are logged there. You need root privileges to access that file.

share|improve this answer
add comment

The last command is the command-line approach. See man last for the options.

It searches through /var/log/wtmp for login details.

You may be able to do so programmatically.

share|improve this answer
    
Thanks for the quick answer. It hit directly on the right point and I'll accept the answer immediately :) –  mico Jun 13 '11 at 13:36
    
sorry I found another, even more suitable one :( I would give you a vote still, if I had rights :) –  mico Jun 13 '11 at 13:45
    
well... someone did, so I'm still ahead of where I was yesterday. –  pavium Jun 13 '11 at 13:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.