[Klug-general] Auditing SSH login sessions

[Colin McCarthy]

On 27 May 2011 14:07, Paul Littlefield <info at paully.co.uk> wrote:

> On 27/05/11 12:52, Colin McCarthy wrote:
>
>> What does the pts/* stand for?
>
>
> It literally stand for 'pseudo terminal slave' and means a remote session.
>
> If you were standing in front of the keyboard and monitor and logged in you
> would see 'tty'...
>
> paully   tty7         Fri May 27 12:19   still logged in    :0
> paully   tty7         Fri May 27 08:26 - 08:57  (00:30)     :0


Cheers. I dont seem to have a /var/log/auth.log file which you asked about
in your first email.

Running 'last -a |grep useraccount' in /var/log/audit/ has given me results
for the last 30 days. Which is want I needed.

Thanks again all.

Colin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.lug.org.uk/pipermail/kent/attachments/20110527/6f3a5e79/attachment.htm>