Thursday, December 06, 2007

See the users that logged into your server for the last year


In a Forum a user has asked something very interesting, how to see which users logged into the server for the last month, ok, i will explain how to see the users that logged in for the last year :)

1) Edit /etc/logrotate.conf, there is setup the configuration from the log rotation of /var/log/wtmp, this file has the information of the users that logged in and is read by the command "last".

My section inside logrotate.conf looks like this now:

/var/log/wtmp {
monthly
create 0664 root utmp
rotate 12
}

Meanings>
monthly : Log files are rotated the first time logrotate is run in a month (this is normally on the first day of the month). rotate [count] : Log files are rotated times before being removed or mailed to the address specified in a mail directive. If count is 0, old versions are removed rather then rotated.
2) When you want to watch which users logged in, you would like to use a script like this:
for i in /var/log/wtmp*; do last -f $i; done

3) The output would be a list with the users ;-)


0 comentarios: