EC2 and login logging

Question

Hello - I have set up several EC2 instances and intend to give multiple users access to them via SSH. Is there any file on the server that monitors who logs in and when?

Any help greatly appreciated.

Max.

Answer 1

SSH logins are usually logged automatically in /var/log/auth.log. You can grep this file to check who logged in and when.

If you do not have an auth.log, you may need to check /etc/syslog.conf and make sure you have the following line: auth.* /var/log/auth.

Answer 2

In addition to the auth log Daniel mentioned, assuming you're using Linux on your EC2 instance (which is likely), see:

• the last(1) command, which reads /var/log/utmp
• the utmp(5) file formats and the getutent() C function.