access logs on the server

[hortonhearsawho]

Hi,

is there an access log on suse that i can review or enable that would tell me what ip or user accesses the server? If not native are there any third party software that would do this? thanks for your help.

 

[Noway2]

This information should be in a combination of the 'secure' log, as well as the utemp and wtemp logs. See this link for more details.:

http://www.cyberciti.biz/faq/opensuse-linux-how-to-read-logs-log-files/

The utemp and wtemp logs are binary and you won't read them directly. Instead The commands, lastlog, last, and who will probably be of interest to you too. As root run the lastlog, last and who commands to check who has accessed your server. The secure log will also show you SSH connection attempts.

 

[hortonhearsawho]

hi thank you for you quick reply. i do not have the secure or the utemp and wtemp logs on my server. is there a way to enable these? thanks again

 

[Noway2]

Those are pretty standard log files and I am surprised that you don't have them as you are using an enterprise grade of Linux (Suse). In place of the secure log, this information may be in the messages. With respect to enabling the logs, here is a link to the opensuse logging documentation:

http://doc.opensuse.org/products/draft/SLES/SLES-tuning_sd_draft/cha.tuning.logfiles.html

According to that link you should have at least messages, and wtmp, which should show you the SSH and local login attempts.