Linux:Syslog

lastmod 2018-12-26created 2015-01-157 edits

Checking Linux access logs

last: shows recent login records and recent reboot records.
- Use last 계정명 to check logins for a specific account.
lastlog: last login record for each account.
- Use lastlog -t n to check login records for the past n days.

$ cat /var/log/secure* | grep Accepted | awk '{print $9"\t"$11"\t"$14}' | sort | uniq

Log name	Log file	Related daemon	Description
Kernel log	`/dev/console`		Log printed to the console
System log	`/var/log/messages`	syslogd	Linux kernel log and main log
Security log	`/var/log/secure`	inetd	Log from inetd. Login authentication records for ssh and telnet connections.
Mail log	`/var/log/maillog`	sendmail popper	Mail log (log from sendmail)
Cron log	`/var/log/cron`	crond	Log from crond
Boot log	`/var/log/boot.log`		Log from system boot
FTP log	`/var/log/xferlog`	ftpd	ftp log
Web log	`/usr/local/apache/logs/access_log`	httpd	Apache (web server) log
Name server log	`/var/log/named.log`	named	Name server (DNS) log