I want to find out if someone has logged in or tried to log into my account in my absence in Ubuntu 14.04.
The documentation reports on the files /var/log/lastlog and /var/log/faillog , which store this information, and are intended to be read by programs. I have these files, but they have not been updated for a long time:
/ var / log $ ls -l faillog
-rw-r - r-- 1 root root 32192 Sep. 30 2015 faillog
/ var / log $ ls -l lastlog
-rw-rw-r-- 1 root utmp 293752 Feb. 18 15:33 lastlog
Team naturally
$ lastlog -u user-name
and
$ faillog -a
show outdated information.
I would like to understand why they are not updated, and how to fix it.
I found the information I was interested in in the /var/log/auth.log file, but there it is not entirely clear. From time to time he goes through all the users, and writes something about everyone
Jul 17 18:02:05 mymachine lightdm: PAM unable to dlopen (pam_kwallet.so): /lib/security/pam_kwallet.so: can not be shared
Jul 17 18:02:05 mymachine lightdm: PAM adding faulty module: pam_kwallet.so
Jul 17 18:02:05 mymachine lightdm: pam_succeed_if (lightdm: auth): requirement "user ingroup nopasswdlogin" not met by user "XXX"
What would it mean?
Update: Following the advice of askubuntu.com, I tried to log in from the console ( Ctrl + Alt + F1 ), with the correct password and the wrong one. The file /var/log/lastlog updated, so it's all right. A /var/log/faillog not changed: (.
The above answer suggests checking the logins with the ck-history --last . (For this command, you need to install the consolekit package.) The results are somewhat strange:
$ date
Mon July 18 17:29:21 IDT 2016
$ ck-history --last | grep Jul \ 18
lightdm LoginWindow Session66 Seat1 tty7: 0 Fri Jul 18 17:26 - 17:32 (00:06)
lightdm LoginWindow Session65 Seat1 tty9: 2 Fri Jul 18 16:54 - 16:55 (00:00)
XXX Session64 Seat1 ??? Fri Jul 18 16:54 - 16:54 (00:00)
XXX Session63 Seat1 ??? Fri Jul 18 16:54 - 16:54 (00:00)
XXX Session62 Seat1 ??? Fri Jul 18 16:54 - 16:54 (00:00)
XXX Session61 Seat1 ??? Fri Jul 18 16:54 - 16:54 (00:00)
...
Pay attention to the day of the week. What am I doing wrong?
