Security Monitoring Using last Command

0

I am new to linux administration and was looking for a good way to get e-mail alerts when a user logs in. I was thinking this might be useful as a security monitoring tool to allow me to see who is on the system in almost real time. I know that using the 'last' command I can see who logged in and when along with IP they used to log in. Does anyone know of a way I could get the output of this command e-mailed to me when it changes? Is there a better way to do this?

poltj18

Posted 2014-09-18T18:51:29.917

Reputation: 109

Usually there is a script in /etc (like /etc/profile) that gets executed when a user logs in. This might be a better place to accomplish what you want. – Steve – 2014-09-18T18:59:19.067

1Remember that your users have a reasonable expectation of privacy and that sysadmins have special responsibilities to protect said data (and privacy) in most jurisdictions. – Jan – 2014-09-18T22:33:29.810

No answers