Linux 用户登录记录
简介
服务器很多时候哦都是会开放远程登录端口，这时候我们就会关注 用户登录记录 。
在 Linux 上，有关用户登录的信息记录在 utmp(/var/run/utmp)、wtmp(/var/log/wtmp)、btmp(/var/log/btmp) 和 lastlog(/var/log/lastlog) 等文件中。
查看当前登录着的用户
who、w 和 users 等命令通过 utmp(/var/run/utmp) 文件查询当前登录用户的信息。
w
会有系统对应的启动信息，登录用户数，负载，和登录用户信息，信息比较多。
11:25:23 up 36 min, 1 user, load average: 0.00, 0.01, 0.02
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root pts/1 manjaro.example.com 11:15 3.00s 0.05s 0.00s w
who
用户名，终端，登录时间（主机 IP 或者对应的域名）
root pts/1 2020-03-23 11:15 (manjaro.example.com)
users
这个就直接显示登录的用户，没有其他信息，信息比较简洁。
root
历史用户登录信息
last 和 ac 命令通过 wtmp (/var/log/wtmp) 文件查询当前与过去登录系统的用户的信息。
last
root pts/0 manjaro.example. Mon Mar 23 11:26 still logged in
root pts/1 gateway Mon Mar 23 11:15 - 11:26 (00:11)
root pts/0 gateway Mon Mar 23 11:14 - 11:15 (00:00)
reboot system boot 3.10.0-1062.18.1 Mon Mar 23 10:48 - 11:29 (00:41)
reboot system boot 3.10.0-1062.18.1 Mon Mar 23 10:47 - 10:48 (00:00)
root pts/0 gateway Mon Mar 23 10:37 - down (00:10)
root pts/0 gateway Mon Mar 23 10:37 - 10:37 (00:00)
reboot system boot 3.10.0-957.el7.x Mon Mar 23 10:35 - 10:47 (00:11)
wtmp begins Mon Mar 23 10:35:50 2020
ac –debug
这个命令，默认没有安装
yum -y install psacct
可以通过 yum 直接安装
ac --debug
---------------------------------------------------------------------------
CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-957.el7.x86_64 |Mon Mar 23 10:35:50 2020
/var/log/wtmp:1: problem: time warp (Thu Jan 1 08:00:00 1970 -> Mon Mar 23 10:35:50 2020)
---------------------------------------------------------------------------
CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-957.el7.x86_64 |Mon Mar 23 10:35:53 2020
---------------------------------------------------------------------------
CURRENT REC: |tty1 |5|tty1| 1814| |Mon Mar 23 10:35:53 2020
---------------------------------------------------------------------------
CURRENT REC: LOGIN |tty1 |6|tty1| 1814| |Mon Mar 23 10:35:53 2020
---------------------------------------------------------------------------
CURRENT REC: root |pts/0 |7|ts/0| 3641|gateway |Mon Mar 23 10:37:03 2020
** pts/0 root Mon Mar 23 10:37:03 2020
---------------------------------------------------------------------------
CURRENT REC: |pts/0 |8| | 3637| |Mon Mar 23 10:37:07 2020
0.00 root (logout)
---------------------------------------------------------------------------
CURRENT REC: root |pts/0 |7|ts/0| 3685|gateway |Mon Mar 23 10:37:24 2020
** pts/0 root Mon Mar 23 10:37:24 2020
---------------------------------------------------------------------------
CURRENT REC: |tty1 |8|tty1| 1814| |Mon Mar 23 10:47:37 2020
/var/log/wtmp:8: problem: missing login record for `tty1'
** pts/0 root Mon Mar 23 10:37:24 2020
---------------------------------------------------------------------------
CURRENT REC: shutdown |~ |1|~~ | 0|3.10.0-957.el7.x86_64 |Mon Mar 23 10:47:38 2020
0.17 root (shutdown)
---------------------------------------------------------------------------
CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:47:46 2020
---------------------------------------------------------------------------
CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:47:50 2020
---------------------------------------------------------------------------
CURRENT REC: |tty1 |5|tty1| 616| |Mon Mar 23 10:47:50 2020
---------------------------------------------------------------------------
CURRENT REC: LOGIN |tty1 |6|tty1| 616| |Mon Mar 23 10:47:50 2020
---------------------------------------------------------------------------
CURRENT REC: |tty1 |8|tty1| 616| |Mon Mar 23 10:47:59 2020
/var/log/wtmp:14: problem: missing login record for `tty1'
---------------------------------------------------------------------------
CURRENT REC: shutdown |~ |1|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:48:01 2020
---------------------------------------------------------------------------
CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:48:25 2020
---------------------------------------------------------------------------
CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:48:27 2020
---------------------------------------------------------------------------
CURRENT REC: |tty1 |5|tty1| 617| |Mon Mar 23 10:48:27 2020
---------------------------------------------------------------------------
CURRENT REC: LOGIN |tty1 |6|tty1| 617| |Mon Mar 23 10:48:27 2020
---------------------------------------------------------------------------
CURRENT REC: root |pts/0 |7|ts/0| 8379|gateway |Mon Mar 23 11:14:46 2020
** pts/0 root Mon Mar 23 11:14:46 2020
---------------------------------------------------------------------------
CURRENT REC: root |pts/1 |7|ts/1| 8401|gateway |Mon Mar 23 11:15:07 2020
** pts/0 root Mon Mar 23 11:14:46 2020
** pts/1 root Mon Mar 23 11:15:07 2020
---------------------------------------------------------------------------
CURRENT REC: |pts/0 |8| | 8376| |Mon Mar 23 11:15:45 2020
0.02 root (logout)
** pts/1 root Mon Mar 23 11:15:07 2020
---------------------------------------------------------------------------
CURRENT REC: |pts/1 |8| | 8398| |Mon Mar 23 11:26:51 2020
0.20 root (logout)
---------------------------------------------------------------------------
CURRENT REC: root |pts/0 |7|ts/0| 8511|manjaro.example.com |Mon Mar 23 11:26:52 2020
** pts/0 root Mon Mar 23 11:26:52 2020
---------------------------------------------------------------------------
CURRENT REC: |tty1 |8|tty1| 617| |Mon Mar 23 11:31:45 2020
/var/log/wtmp:25: problem: missing login record for `tty1'
** pts/0 root Mon Mar 23 11:26:52 2020
---------------------------------------------------------------------------
CURRENT REC: shutdown |~ |1|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 11:31:47 2020
0.08 root (shutdown)
---------------------------------------------------------------------------
CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 11:31:54 2020
---------------------------------------------------------------------------
CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 11:31:56 2020
---------------------------------------------------------------------------
CURRENT REC: |tty1 |5|tty1| 605| |Mon Mar 23 11:31:56 2020
---------------------------------------------------------------------------
CURRENT REC: LOGIN |tty1 |6|tty1| 605| |Mon Mar 23 11:31:56 2020
---------------------------------------------------------------------------
CURRENT REC: root |pts/0 |7|ts/0| 1192|manjaro.example.com |Mon Mar 23 11:32:02 2020
** pts/0 root Mon Mar 23 11:32:02 2020
0.07 root (catch-up)
total 0.53
查看登录失败记录
lastb 命令通过 btmp(/var/log/btmp) 文件查询所有登录系统失败的用户的信息。
lastb
admin ssh:notty manjaro.example. Mon Mar 23 11:38 - 11:38 (00:00)
admin ssh:notty manjaro.example. Mon Mar 23 11:38 - 11:38 (00:00)
admin ssh:notty manjaro.example. Mon Mar 23 11:38 - 11:38 (00:00)
btmp begins Mon Mar 23 11:38:00 2020
所有用户最后一次登录记录
lastlog 命令通过 lastlog(/var/log/lastlog) 文件查询用户最后一次登录的信息。
lastlog
Username Port From Latest
root pts/0 manjaro.example. Mon Mar 23 11:32:02 +0800 2020
bin **Never logged in**
daemon **Never logged in**
adm **Never logged in**
lp **Never logged in**
sync **Never logged in**
shutdown **Never logged in**
halt **Never logged in**
mail **Never logged in**
operator **Never logged in**
games **Never logged in**
ftp **Never logged in**
nobody **Never logged in**
systemd-network **Never logged in**
dbus **Never logged in**
polkitd **Never logged in**
sshd **Never logged in**
postfix **Never logged in**
chrony **Never logged in**
jalright pts/1 Mon Mar 23 11:15:40 +0800 2020
- 原文作者：Linux运维菜
- 原文链接：https://www.opcai.top/post/2020/2020-03/linux_loginlog/
- 版权声明：本作品采用进行许可，非商业转载请注明出处（作者，原文链接），商业转载请联系作者获得授权。