https://community.splunk.com/t5/Splunk-Search/Linux-Successful-Login/m-p/148985#M41636 <P>Hi garima_chauhan,</P> <P>this is more likely a problem of your Linux box, then a Splunk problem. I suggest that you ask <A href="http://www.google.com">Dr. Google</A> regarding where your Linux distribution stores this kind of information. After that you can follow the <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor">docs</A> on how to get data into Splunk.</P> <P>Remember your data must be human readable, meaning a non-binary file.</P> <P>hope this helps ...</P> <P>cheers, MuS</P> Thu, 13 Feb 2014 11:37:25 GMT MuS 2014-02-13T11:37:25Z https://community.splunk.com/t5/Splunk-Search/Linux-Successful-Login/m-p/148984#M41635 <P>Hi,</P> <P>I want to create a query displaying successful logins in Linux. I have /var/log/secure logs but I cannot find anything like login,authentication successful or any other related keyword in these logs. I tried with the wtmp logs as well but I will have to provide a script in that case.<BR /> My linux box does not have auth.log. Please suggest as to which log file shall I monitoror if there is an easier way of monitoring the wtmp logs in readable format.</P> Thu, 13 Feb 2014 08:43:24 GMT https://community.splunk.com/t5/Splunk-Search/Linux-Successful-Login/m-p/148984#M41635 garima_chauhan 2014-02-13T08:43:24Z https://community.splunk.com/t5/Splunk-Search/Linux-Successful-Login/m-p/148985#M41636 <P>Hi garima_chauhan,</P> <P>this is more likely a problem of your Linux box, then a Splunk problem. I suggest that you ask <A href="http://www.google.com">Dr. Google</A> regarding where your Linux distribution stores this kind of information. After that you can follow the <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor">docs</A> on how to get data into Splunk.</P> <P>Remember your data must be human readable, meaning a non-binary file.</P> <P>hope this helps ...</P> <P>cheers, MuS</P> Thu, 13 Feb 2014 11:37:25 GMT https://community.splunk.com/t5/Splunk-Search/Linux-Successful-Login/m-p/148985#M41636 MuS 2014-02-13T11:37:25Z https://community.splunk.com/t5/Splunk-Search/Linux-Successful-Login/m-p/148986#M41637 <P>I do not know what the issue was, but now I am able to see an entry like: Accepted password for username in the logs.<BR /> Thanks.</P> Thu, 13 Feb 2014 12:15:45 GMT https://community.splunk.com/t5/Splunk-Search/Linux-Successful-Login/m-p/148986#M41637 garima_chauhan 2014-02-13T12:15:45Z https://community.splunk.com/t5/Splunk-Search/Linux-Successful-Login/m-p/148987#M41638 <P>no problem - feel free to accept the answer</P> Thu, 13 Feb 2014 12:20:00 GMT https://community.splunk.com/t5/Splunk-Search/Linux-Successful-Login/m-p/148987#M41638 MuS 2014-02-13T12:20:00Z