linux命令日志抓取,Linux：如何从我的系统获取所有登录日志

我想知道自去年以来用户记录到我的系统中的所有时间？

我使用了最后一个命令,但没用.

解决方法:

redhat-style linux上的登录日志称为wtmp(man wtmp),默认存储在/ var / log /中,您可以使用utmpdump(在RHEL6上)检索它们.

[root@server ~]# utmpdump /var/log/wtmp* | awk '$4~"root" {print}'

Utmp dump of /var/log/wtmp

[7] [01320] [ts/0] [root ] [pts/0 ] [192.168.1.101 ] [192.168.1.101 ] [Tue Sep 24 00:31:47 2013 UTC]

[7] [01817] [ts/3] [root ] [pts/3 ] [192.168.1.101 ] [192.168.1.101 ] [Tue Sep 24 00:38:22 2013 UTC]

[7] [01690] [ts/0] [root ] [pts/0 ] [192.168.1.101 ] [192.168.1.101 ] [Tue Sep 24 00:59:04 2013 UTC]

[7] [23641] [ts/0] [root ] [pts/0 ] [192.168.1.101 ] [192.168.1.101 ] [Wed Sep 25 19:12:44 2013 UTC]

[7] [03020] [ts/0] [root ] [pts/0 ] [192.168.1.100 ] [192.168.1.100 ] [Fri Sep 27 21:33:40 2013 UTC]

...

标签：linux,login,logs

来源： https://codeday.me/bug/20190809/1634272.html