I would like to monitor a worker

rldev

Verified User
Joined
May 26, 2004
Messages
1,072
Hello Folks,
I would like to monitor someone doing work on my server. I would like to know when they log in and for how long. What log should I be looking for. Access is over SSH.
 
/var/log/secure shows all sshd info. It shows authentication, sessions and failures. However, i do not believe is shows closed. You will have to look in your /var/log/messages for the "server login(pam_unix)[14790]: session closed for user BLAH" to find out when the session was closed.
 
Under most linux flavors, the "last" command will show you time logged in and out of the system.
 
OI! I knew there was a command that I was forgetting about. Yeah, just use 'last' and look for that username and "pts/*". :) Thanks ballyn.
 
Back
Top