This topic describes how to obtain user logon records on a Linux Elastic Compute Service (ECS) instance.
Files related to logon records
The following files are related to logon records:
Typically, user logon information is recorded in files such as
/var/run/utmp,/var/log/wtmp,/var/log/btmp, and/var/log/lastlog.The
who,w, anduserscommands can be run to query the information of the current logon user in the/var/run/utmpfile.The
lastandaccommands can be run to query the information of current and historical logon users in the/var/log/wtmpfile.The
lastbcommand can be run to query the information of all users who failed to log on in the/var/log/btmpfile.The
lastlogcommand can be run to query information about the last logons of users in the/var/log/lastlogfile.
Commands
who
The who command is used to query the information of the current logon user. A command output similar to the following is returned.
w
The w command is used to query the username of the current logon user and the tasks that the user is executing. A command output similar to the following is returned.
users
The users command is used to query the username of the current logon user. A command output similar to the following one is returned.
last
The last command is used to query the information of all users who have logged on by now. A command output similar to the following one is returned.
lastb
The lastb command is used to query the information of all users who failed to log on. A command output similar to the following one is returned.
lastlog
The lastlog command is used to query information about the last logons of users. A command output similar to the following one is returned.
cat /var/log/secure
The cat /var/log/secure command is used to query the logon records of all users. A command output similar to the following one is returned.
