Page 1 of 1
Show login history
Posted: 27 May 2019 08:14
by lecramV
Hey guys,
I couldn't find any answer to this topic in the forum.
Is it possible to get a history of all users that logged in into the efa?
Thanks.
Re: Show login history
Posted: 27 May 2019 15:59
by henk
In the Gui-> Search and Reports->Audit Log
As there is housekeeping on this log, it will show the last 60 days, if I remember well
Re: Show login history
Posted: 28 May 2019 06:28
by lecramV
Hey thanks for the answer,
but I just see which actions were performed not the log in into efa itself.
Is there a way to do that?
But still thanks
Re: Show login history
Posted: 28 May 2019 07:30
by henk
You are right, so just did a test to see when someone logged in with ssh:
1. /var/log/secure
Code: Select all
grep -irHn 'Accepted password' /var/log/secure
/var/log/secure:7794:May 28 09:05:09 efa sshd[10331]: Accepted password for <user> from <IP> port 49517 ssh2
/var/log/secure:7800:May 28 09:05:09 efa sshd[10334]: Accepted password for <user> from <IP> port 49518 ssh2
2 to search in history files (.gz)
Code: Select all
find /var/log -name 'secure*.gz' -exec zgrep -- 'Accepted password' {} +
/var/log/secure-20190519.gz:May 13 15:26:09 efa sshd[10477]: Accepted password for <user> from <IP> port 49446 ssh2
/var/log/secure-20190519.gz:May 13 15:26:09 efa sshd[10480]: Accepted password for <user> from <IP> port 49447 ssh2
/var/log/secure-20190519.gz:May 14 15:34:31 efa sshd[16508]: Accepted password for <user> from <IP> port 51970 ssh2
/var/log/secure-20190519.gz:May 14 15:34:31 efa sshd[16511]: Accepted password for <user> from <IP> port 51971 ssh2
Re: Show login history
Posted: 03 Jun 2019 06:43
by lecramV
Thank you very much!