lastlog

Last: View current and past user login information[[emailprotected] ~]# lastroot pts/0 192.168.1.106 Fri June 09:53 still logged in admin tty1 : 0 Fri June 09:47 still logged in root tty5 Fri June 09:31 still logged in reboot System boot 2.6.32-431.el6.x Fri June 17:35-09:56 ( -7:-38) root tty5 Fri June 3 07:31 -Down (00:34) reboot system boot 2.6.32-431.el6.x Fri June 3 07:27-08:06 (00:39) root tty5 Fri June 3 07:21-down (00:04) Admin tty1

configuration file-m,–create-home Automatically create login directories-L, do not add the user to the Lastlog file-M, do not create the login directory automatically-R, set up the system account-o,–non-unique allows the user to have the same UID-p,–password password using encrypted passwords for new users-s,–shell Shell Login Time Shell-u,–uid UID Specifies a UID for the new user-z,–selinux-user Seuser use a specific seuser for the SELinux user mapp

First, the cause of the common crashSecond, log analysisThe log system, which is controlled by the Rsyslog.service service, is used to record the system kernel and the log information of each application respectively. Configuration file/etc/rsyslog.conf/var/log/messages records system kernel messages and common log information for various applications, including startup, IO error, network error, program error, etc., for applications or services that do not use stand-alone log files, you can gene

functionality implementationWarning Alert information (warning message)Notice general conditions of importance (common but important messages)Message (Informational message) for infoDebug does not contain additional information about a function condition or problem (debug level-most information)None has no important level and is usually used for troubleshooting (no log messages are logged)* All levels, except noneAction1./var/log/lastlog: Records the

??????????????????? Help-k,–skel Skel_dir?????????? Specify a different Skel directory-k,–key Key=value?????????? Overwrite/etc/login.defs configuration file-m,–create-home???????????? Automatically create a login directory-L,?????????????????????????? Do not add users to the Lastlog file-M,?????????????????????????? Do not automatically create a login directory-R,?????????? ???????????????? Create a System account-o,–non-unique????????????? Allow use

,–create-home Automatically create login directories-L, do not add the user to the Lastlog file-M, do not create the login directory automatically-R, set up the system account-o,–non-unique allows the user to have the same UID-p,–password password using encrypted passwords for new users-s,–shell Shell Login Time Shell-u,–uid UID Specifies a UID for the new user-z,–selinux-user Seuser use a specific seuser for the SELinux user mapping[Email protected]

login command is also recorded in this file. /var/log/fontconfig.log- log associated with the font configuration . /var/log/fsck- File System log/var/log/faillog- contains user logon failure information. In addition, the error login command is also recorded in this file. /var/log/hp//var/log/install//var/log/jokey.log/var/log/kern.log – Contains logs generated by the kernel to help resolve issues when customizing the kernel. /var/log/lastlog- record

The log of connection time in Linux is usually recorded by the two files of/var/log/wtmp and/var/run/utmp, but these two files cannot be viewed directly with cat, and the file is automatically updated by the system, we can use W, who, Finger, ID, Last, Lastlog, ac command to view.Linux in the monitoring log for the process, first of all, the process monitoring log in the monitoring of the user's operation instructions is very effective, when the serve

############The most important use of snort is also as a network intrusion detection system (NIDS), using the following command line to start this mode:./snort-d-L/log-h 192.168.0.0/24-c snort.confNine, Linux log analysisLinux Log System classificationConnection time Log--The connection time log is executed by multiple programs, writing records to/var/log/wtmp and/var/run/utmp. Login and other programs update the WTMP and utmp files so that system administrators can track who is logged on to the

possible to obtain related event logging information from the file. 2. >/var/log/cron: Log event messages generated by Crond scheduled tasks. 3. >/VARLOG/DMESG: Record the various event information of the Linux system during the boot process. 4. >/var/log/maillog: Record the e-mail activity that enters or issues the system. 5. >/var/log/lastlog: Recent successful logon events and last unsuccessful logon events. 6. >/var/log/rpmpkgs: Install each RPM

"style=" border:0px; "/>3.lastlog command to view the users on the host650) this.width=650; "src=" Http://www.linuxidc.com/upload/2017_04/170421183587691.png "width=" 705 "vspace=" 5 "style = "border:0px;"/>[Email protected]/]# Lastlog | Head-n 15Username Port from LatestRoot pts/0 192.168.146.1 Wed Apr 19 03:19:47-0400 2017Bin **never Logged in**Daemon **never logged in**ADM **never logged in**LP **never

(1) Send message to User: WriteExample: Write admin (ctrl+d end)(2) Broadcast information: wallExample: Wall Hello world!(3) Test network connectivity: Ping-C Send TimesExample: Ping-c 3 192.168.1.188(4) View, set network card information: ifconfigExample: IfconfigIfconfig eth0 192.168.1.188(5) View, send e-mail: MailExample: MailMail Admin Send MessageH View ListD 3 Delete 3rd(6) View all reboots, user logon hours: Last(7) View all users last login time: La