Vagner Rodrigues <vag...@litrixlinux.org> writes: > Hi Folks ! > > > Somebody know how I to so send mail with IP and Date/time when same > user login on shell ( remote or local ) ? > > I work with another admin's and I never told me when they access and > for what my server to do something, I try log but this can be erased > and maybe mail can help me about access and with this I can Ask about > this access.
Do you really think the other admins would be erasing logs? one way to get some input would be to run your own script that calls `w' who `who' every half hour and writes it to a file with `>>' redirect. Then once a day the script could mail you the resulting file. If the other admins are logging in as root... you would see where they were logging in from... and possibly identify them that way... also `w' may give a little hint as to what they are doing. Some scanning of the output file would reveal quite a lot of info over time. look at `man w' or `man who' for what you would be getting The output might look something like this...showing who is logged in and from where: w [...] USER TTY FROM LOGIN@ IDLE WHAT jhc p1 pool-173-70-160- 2:36AM 0 /bin/ksh cytroic p3 fw1.appliedcard. 02Jul09 7days screen -x st p4 mais2.cat.utexas Wed07PM 20:26 -bash rob pa 216-239-45-4.goo Sun11PM 27 screen -rd dwa ph 68-116-196-242.d 8:10PM 1:00 -bash reader pk c-98-215-178-110 9:57PM 0 w mage pq c-65-34-215-99.h Fri10PM 5days screen -r Or use `who' to get a full print of the remote hosts users are logging in from: who jhc ttyp1 Jul 30 02:36 (pool-173-70-160-108.nwrknj.fios.) cytroic ttyp3 Jul 2 13:59 (fw1.appliedcard.com) st ttyp4 Jul 29 19:05 (mais2.cat.utexas.edu) rob ttypa Jul 26 23:50 (216-239-45-4.google.com) dwa ttyph Jul 30 20:10 (68-116-196-242.dhcp.oxfr.ma.char) reader ttypk Jul 30 21:57 (c-98-215-178-110.hsd1.in.comcast) mage ttypq Jul 24 22:49 (c-65-34-215-99.hsd1.fl.comcast.n)
