Live Linux Forensics training coming up @WWHackinFest Deadwood! Let's do some daily Linux Forensics trivia as a lead-up! wildwesthackinfest.com/deadw…
34
50
2
95
Daily Linux Forensics Trivia #26 - Name three different logs where you can normally find a record of user logins.
2
1
Trivia Answer #26 - I should have been more specific here. I was looking for logs that track successful user logins over time and I was thinking of Syslog's LOG_AUTHPRIV stream (usually /var/log/auth.log or .../secure), the wtmp file, and the audit.log.
2
1
However, @ldsopreload mentioned several other places where login information is tracked, including the btmp (failed logins), and lastlog (detail on most recent login for each user) logs.

Oct 2, 2022 · 11:43 AM UTC