Linux Successful Login

[garima_chauhan]

Hi,

I want to create a query displaying successful logins in Linux. I have /var/log/secure logs but I cannot find anything like login,authentication successful or any other related keyword in these logs. I tried with the wtmp logs as well but I will have to provide a script in that case.
My linux box does not have auth.log. Please suggest as to which log file shall I monitoror if there is an easier way of monitoring the wtmp logs in readable format.

[MuS · Accepted solution]

Hi garima_chauhan,

this is more likely a problem of your Linux box, then a Splunk problem. I suggest that you ask Dr. Google regarding where your Linux distribution stores this kind of information. After that you can follow the docs on how to get data into Splunk.

Remember your data must be human readable, meaning a non-binary file.

hope this helps ...

cheers, MuS

[MuS]

no problem - feel free to accept the answer

[garima_chauhan]

I do not know what the issue was, but now I am able to see an entry like: Accepted password for username in the logs.
Thanks.