Getting Instance Login Logs
Last updated: 2024-01-06 17:38:11
Getting Instance Login Logs
Last updated: 2024-01-06 17:38:11
Overview
This document describes how to obtain user login records of a CVM instance.
Directions
Note:
This document uses a Linux instance on TencentOS Server 3.1 (TK4) as an example. As the steps may vary by operating system, proceed based on the actual conditions.
2. You can view the following user login information as needed:
Note:
User login logs are usually stored in the /var/run/utmp
, /var/log/wtmp
, /var/log/btmp
, and /var/log/lastlog
files.
Run the who
command to view the information of the currently logged-in user in the /var/run/utmp
file. The returned result is as follows:
Run the w
command to view the username of the currently logged-in user and display the currently executed tasks of the user in the /var/run/utmp
file. The returned result is as follows:
Run the users
command to view the username of the currently logged-in user in the /var/run/utmp
file. The returned result is as follows:
Run the last
command to view the information of the currently and historically logged-in users in the /var/log/wtmp
file. The returned result is as follows:
Run the lastb
command to view the information of all the users who failed to log in to the system in the /var/log/btmp
file. The returned result is as follows:
Run the lastlog
command to view the last user login information in the /var/log/lastlog
file. The returned result is as follows:
Run the cat /var/log/secure
command to view the login information. The returned result is as follows:
Note:
This document uses a Windows instance on Windows Server 2012 R2 English as an example. As the steps may vary by operating system, proceed based on the actual conditions.
2. On the desktop, click to open Server Manager. 3. In the Server Manager window, select Tools > Event Viewer in the top-right corner.
4. In the Event Viewer pop-up window, select Windows Logs > Security on the left and click Filter Current Log on the right.
5. In the Filter Current Log pop-up window, enter 4648
in <All Event IDs> and click OK.
6. In the Event Viewer window, double-click the logs that meet the filters.
7. In the Event Property pop-up window, click Details to view the client name and address as well as event recording time.