I would like to monitor a worker

R

rldev

Verified User
Joined
May 26, 2004
Messages
1,003
Hello Folks,
I would like to monitor someone doing work on my server. I would like to know when they log in and for how long. What log should I be looking for. Access is over SSH.
 
/var/log/secure shows all sshd info. It shows authentication, sessions and failures. However, i do not believe is shows closed. You will have to look in your /var/log/messages for the "server login(pam_unix)[14790]: session closed for user BLAH" to find out when the session was closed.
 
OI! I knew there was a command that I was forgetting about. Yeah, just use 'last' and look for that username and "pts/*". :) Thanks ballyn.
 
You must log in or register to reply here.
Back
Top