1.用户登录日志信息
- /var/run/utmp:记录当前正在登录系统的用户信息,默认由who和w记录当前登录用户的信息,uptime记录系统启动时间;
- /var/log/wtmp:记录当前正在登录和历史登录系统的用户信息,默认由last命令查看;
- /var/log/btmp:记录失败的登录尝试信息,默认由lastb命令查看
2.查看用户登录命令
w:查看当前登入系统的用户信息及用户当前的进程
[root@H0f ~]# w
22:03:33 up 29 days, 4:47, 1 user, load average: 0.00, 0.01, 0.05
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root pts/0 58.212.128.136 21:57 5.00s 0.00s 0.00s w
last:当前和曾经登入系统的用户信息
[root@H0f ~]# last
root pts/0 58.212.128.136 Wed Jun 13 21:57 still logged in
root pts/0 58.212.128.136 Tue Jun 12 23:32 - 00:11 (00:38)
root pts/0 171.35.57.52 Thu May 31 12:50 - 16:19 (03:29)
root pts/0 171.35.58.117 Mon May 28 21:07 - 21:37 (00:29)
root pts/1 180.169.225.186 Fri May 25 17:17 - 18:23 (01:05)
root pts/0 180.169.225.186 Fri May 25 16:58 - 18:23 (01:24)
root pts/1 180.169.225.186 Fri May 25 15:10 - 16:32 (01:21)
root pts/0 180.169.225.186 Fri May 25 09:45 - 16:32 (06:46)
root pts/0 112.64.60.8 Fri May 25 00:18 - 00:25 (00:06)
root pts/0 180.169.225.186 Thu May 24 10:29 - 21:35 (11:05)
who:当前用户登录信息
[root@H0f ~]# who -q #用户登录数量
root
# users=1
[root@H0f ~]# who -rH #用户登录级别
NAME LINE TIME IDLE PID COMMENT
run-level 3 2018-05-15 17:16
[root@H0f ~]# who #当前用户
root pts/0 2018-06-13 21:57 (58.212.128.136)
user:显示当前正在登入统的用户名
3.操作记录:history
[root@H0f ~]# history
14 config_file:/etc/redis/6379.conf
15 # Clients
16 connected_clients:26
17 client_longest_output_list:0
18 client_biggest_input_buf:14
19 blocked_clients:0
20 # Memory
21 used_memory:1507720
22 used_memory_human:1.44M
23 used_memory_rss:1908736
24 used_memory_peak:1585688
25 used_memory_peak_human:1.51M
26 used_memory_lua:654336
27 mem_fragmentation_ratio:1.27
28 mem_allocator:jemalloc-3.6.0
29 # Persistence