简介
服务器很多时候哦都是会开放远程登录端口，这时候我们就会关注 用户登录记录 。
在 Linux 上，有关用户登录的信息记录在 utmp(/var/run/utmp)、wtmp(/var/log/wtmp)、btmp(/var/log/btmp) 和 lastlog(/var/log/lastlog) 等文件中。
查看当前登录着的用户
who、w 和 users 等命令通过 utmp(/var/run/utmp) 文件查询当前登录用户的信息。
w
会有系统对应的启动信息，登录用户数，负载，和登录用户信息，信息比较多。
11:25:23 up 36 min, 1 user, load average: 0.00, 0.01, 0.02USER TTY FROM LOGIN@ IDLE JCPU PCPU WHATroot pts/1 manjaro.example.com 11:15 3.00s 0.05s 0.00s wwho
用户名，终端，登录时间(主机 IP 或者对应的域名)
root pts/1 2020-03-23 11:15 (manjaro.example.com)
users
这个就直接显示登录的用户，没有其他信息，信息比较简洁。
root历史用户登录信息
last 和 ac 命令通过 wtmp (/var/log/wtmp) 文件查询当前与过去登录系统的用户的信息。
last
root pts/0 manjaro.example. Mon Mar 23 11:26 still logged inroot pts/1 gateway Mon Mar 23 11:15 - 11:26 (00:11)root pts/0 gateway Mon Mar 23 11:14 - 11:15 (00:00)reboot system boot 3.10.0-1062.18.1 Mon Mar 23 10:48 - 11:29 (00:41)reboot system boot 3.10.0-1062.18.1 Mon Mar 23 10:47 - 10:48 (00:00)root pts/0 gateway Mon Mar 23 10:37 - down (00:10)root pts/0 gateway Mon Mar 23 10:37 - 10:37 (00:00)reboot system boot 3.10.0-957.el7.x Mon Mar 23 10:35 - 10:47 (00:11)wtmp begins Mon Mar 23 10:35:50 2020ac –debug
这个命令，默认没有安装
yum -y install psacct可以通过 yum 直接安装
ac --debug---------------------------------------------------------------------------CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-957.el7.x86_64 |Mon Mar 23 10:35:50 2020/var/log/wtmp:1: problem: time warp (Thu Jan 1 08:00:00 1970 -> Mon Mar 23 10:35:50 2020)---------------------------------------------------------------------------CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-957.el7.x86_64 |Mon Mar 23 10:35:53 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |5|tty1| 1814| |Mon Mar 23 10:35:53 2020---------------------------------------------------------------------------CURRENT REC: LOGIN |tty1 |6|tty1| 1814| |Mon Mar 23 10:35:53 2020---------------------------------------------------------------------------CURRENT REC: root |pts/0 |7|ts/0| 3641|gateway |Mon Mar 23 10:37:03 2020**pts/0 root Mon Mar 23 10:37:03 2020---------------------------------------------------------------------------CURRENT REC: |pts/0 |8| | 3637| |Mon Mar 23 10:37:07 2020 0.00 root (logout)---------------------------------------------------------------------------CURRENT REC: root |pts/0 |7|ts/0| 3685|gateway |Mon Mar 23 10:37:24 2020**pts/0 root Mon Mar 23 10:37:24 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |8|tty1| 1814| |Mon Mar 23 10:47:37 2020/var/log/wtmp:8: problem: missing login record for `tty1'**pts/0 root Mon Mar 23 10:37:24 2020---------------------------------------------------------------------------CURRENT REC: shutdown |~ |1|~~ | 0|3.10.0-957.el7.x86_64 |Mon Mar 23 10:47:38 2020 0.17 root (shutdown)---------------------------------------------------------------------------CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:47:46 2020---------------------------------------------------------------------------CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:47:50 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |5|tty1| 616| |Mon Mar 23 10:47:50 2020---------------------------------------------------------------------------CURRENT REC: LOGIN |tty1 |6|tty1| 616| |Mon Mar 23 10:47:50 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |8|tty1| 616| |Mon Mar 23 10:47:59 2020/var/log/wtmp:14: problem: missing login record for `tty1'---------------------------------------------------------------------------CURRENT REC: shutdown |~ |1|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:48:01 2020---------------------------------------------------------------------------CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:48:25 2020---------------------------------------------------------------------------CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 10:48:27 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |5|tty1| 617| |Mon Mar 23 10:48:27 2020---------------------------------------------------------------------------CURRENT REC: LOGIN |tty1 |6|tty1| 617| |Mon Mar 23 10:48:27 2020---------------------------------------------------------------------------CURRENT REC: root |pts/0 |7|ts/0| 8379|gateway |Mon Mar 23 11:14:46 2020**pts/0 root Mon Mar 23 11:14:46 2020---------------------------------------------------------------------------CURRENT REC: root |pts/1 |7|ts/1| 8401|gateway |Mon Mar 23 11:15:07 2020**pts/0 root Mon Mar 23 11:14:46 2020**pts/1 root Mon Mar 23 11:15:07 2020---------------------------------------------------------------------------CURRENT REC: |pts/0 |8| | 8376| |Mon Mar 23 11:15:45 2020 0.02 root (logout)**pts/1 root Mon Mar 23 11:15:07 2020---------------------------------------------------------------------------CURRENT REC: |pts/1 |8| | 8398| |Mon Mar 23 11:26:51 2020 0.20 root (logout)---------------------------------------------------------------------------CURRENT REC: root |pts/0 |7|ts/0| 8511|manjaro.example.com |Mon Mar 23 11:26:52 2020**pts/0 root Mon Mar 23 11:26:52 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |8|tty1| 617| |Mon Mar 23 11:31:45 2020/var/log/wtmp:25: problem: missing login record for `tty1'**pts/0 root Mon Mar 23 11:26:52 2020---------------------------------------------------------------------------CURRENT REC: shutdown |~ |1|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 11:31:47 2020 0.08 root (shutdown)---------------------------------------------------------------------------CURRENT REC: reboot |~ |2|~~ | 0|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 11:31:54 2020---------------------------------------------------------------------------CURRENT REC: runlevel |~ |1|~~ | 51|3.10.0-1062.18.1.el7.x86_64 |Mon Mar 23 11:31:56 2020---------------------------------------------------------------------------CURRENT REC: |tty1 |5|tty1| 605| |Mon Mar 23 11:31:56 2020---------------------------------------------------------------------------CURRENT REC: LOGIN |tty1 |6|tty1| 605| |Mon Mar 23 11:31:56 2020---------------------------------------------------------------------------CURRENT REC: root |pts/0 |7|ts/0| 1192|manjaro.example.com |Mon Mar 23 11:32:02 2020**pts/0 root Mon Mar 23 11:32:02 2020 0.07 root (catch-up)total 0.53查看登录失败记录
lastb 命令通过 btmp(/var/log/btmp) 文件查询所有登录系统失败的用户的信息。
lastb
admin ssh:notty manjaro.example. Mon Mar 23 11:38 - 11:38 (00:00)admin ssh:notty manjaro.example. Mon Mar 23 11:38 - 11:38 (00:00)admin ssh:notty manjaro.example. Mon Mar 23 11:38 - 11:38 (00:00)btmp begins Mon Mar 23 11:38:00 2020所有用户最后一次登录记录
lastlog 命令通过 lastlog(/var/log/lastlog) 文件查询用户最后一次登录的信息。
lastlog
Username Port From Latestroot pts/0 manjaro.example. Mon Mar 23 11:32:02 +0800 2020bin **Never logged in**daemon **Never logged in**adm **Never logged in**lp **Never logged in**sync **Never logged in**shutdown **Never logged in**halt **Never logged in**mail **Never logged in**operator **Never logged in**games **Never logged in**ftp **Never logged in**nobody **Never logged in**systemd-network **Never logged in**dbus **Never logged in**polkitd **Never logged in**sshd **Never logged in**postfix **Never logged in**chrony **Never logged in**jalright pts/1 Mon Mar 23 11:15:40 +0800 2020
5512
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
