Monitoring user activity with utmpdump
Keeping track of user activity is one of the most essential skills associated with any Linux administrator. In situations where user management may be the cause of a troubleshooting session, we can make use of
utmpdump.
User histories are typically stored in the following locations:
/var/run/utmp: The purpose of this binary is to record open sessions. You can review the contents of this file withutmpdump /var/run/utmp./var/run/wtmp: The purpose of this binary is to record connection histories. You can review the contents of this file withutmpdump /var/log/wtmp./var/log/btmp. The purpose of this binary is to record failed login attempts. You can review the contents of this file withutmpdump /var/log/btmp.
Taking this one step further, you can also review the current history of logged sessions contained within /var/run/wtmp by typing:
# last
You can review the current history of logged sessions contained within /var/run/btmp by typing:
# lastb
However...
