Linux:Logging
lastmod 2020-08-11created 2020-08-114 edits
Notes on Linux logging.
Login/Logout
The Linux command lastb shows records of failed logins. Whereas the last command reads the /var/log/wtmp file to show login and reboot records, lastb reads the /var/log/btmp file to show a list of failures. lastb is the same as the last command except that it reads /var/log/btmp, the file that records failed logins.
pam
- CentOS 7
-
/etc/pam.d/common-auth
- Ubuntu 14.04 LTS
-
/etc/pam.d/common-auth
Log files
utmp log file
- Log file containing status information on currently logged-in users
- It is a binary file and can be viewed with commands such as "w", "who", and "finger".
- Location : /var/run/utmp
- "w" command
- USER : login account, TTY : terminal device name, FROM : remote host address, LOGIN@ : login time
- IDLE : idle time with no input, WHAT : current task (command)
wtmp log file
- Log file containing the history of users' successful logins/logouts and system Boot/Shutdown information
- It is a binary file and can be viewed with the "last" command.
- Location : /var/log/wtmp
- "last" command
- Run without arguments, it prints login/logout information for all accounts. To see login/logout information for a specific account, run it in the form "last [ USER ]"
- In order: account name, terminal type, connection address, login time, logout time
- Boot information can be found through the reboot user.
lastlog file
- Log file containing the most recent successful login records
- It is a binary file and can be viewed with "lastlog"
- Location : /var/log/lastlog
- lastlog command
- Shows the most recent login records of all accounts.
- The "-u account_name" option specifies a user to check.
- The "-t days" option shows logins within the given number of days.
btmp log file
- File containing records of failed login attempts
- It is a binary file and can be viewed with the "lastb" command.
- Location : /var/log/btmp
history log file
- File storing a record of commands run by each account
- Located in each account's home directory
- Created as a text file in the form ".shelltype_history" and can be viewed with the "history" command
secure log file
- Log file that mainly records user authentication information such as user/group creation/deletion and logins
- Stores records of remote logins and su command executions, etc.
- Location : /var/log/secure
messages log file
- The most basic system log file of a Linux system, storing general messages about system operation
- Mainly stores the execution status and history of system daemons, user login information, TCP Wrapper access control information, etc.
- Location : /var/log/messages
dmesg log file
- Records all messages printed while Linux boots
- Refer to this file to look into errors or actions taken at boot
- The content can be checked by viewing the text-format log file or with the dmesg command.
- Location : /var/log/dmesg
boot.log log file
- Records file system checks, service daemon execution status, etc. while Linux boots
- Success / failure is recorded
- Location : /var/log/boot.log
xferlog log file
- FTP log file of a Linux system, recording the service history of the proftpd and vsftpd daemons
- Records users who log in via FTP and which files they uploaded/downloaded.
- Location : /var/log/xferlog
cron log file
- Log of the system's periodic tasks, i.e. a file recording system cron jobs
- The cron.hourly, cron.daily, cron.weekly, and cron.monthly directories in /etc contain task script files that the operating system automatically runs hourly, daily, weekly, and monthly, respectively.
- Location : /var/log/cron
mail log file
- A directory that stores users' mail; each user who has used mail at least once has one file with the same name as their user account ID.
- When a user account is created, a mail file with the same name as the account is created in the /var/spool/mail directory.
- If the user saves the mail to their mail directory or deletes it after reading, the content is removed from this file.
- Location : /var/spool/mail
maillog log file
- Records mail sending/receiving history such as sendmail or qmail, and receiving history such as ipop or imap
- Records almost everything related to mail
- Location : /var/log/maillog