Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have a application that running on apache web server, is there any way under apache logs i can identify name / ip address of user who logged into the system.

And also the date / time of who last opened or accessed the logs?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Your Apache access logs should log the IP address of visitors by default.

If your CMS system handles the login and sets a cookie for the logged in user, you must have Apache log that cookie to be able to see the logged in user. You can do so by modifying the log config with the name of the cookie: %{Foobar}C (where Foobar is the name of the cookie).

For more information about Apache logging, see custom log formats.

It sounds like you might be interested in information logged by ssh. You can usually find information about who got command line access to the server with these commands (source):

grep -ir ssh /var/log/*
grep -ir breakin /var/log/*
grep -ir security /var/log/*

You can also look in the .bash_history files of those users (stored in their home directories) to see what commands have been run.

Keep in mind, that once somebody has access to a command line on your server they may cover their tracks by altering the log files.

share|improve this answer
    
is there a command i can type on ubuntu to find last logged in users for e.g 24 hours? –  asadz May 20 '13 at 19:10

Apache by default only logs access and errors, Since accessing a user login authentication is handled by a content management system of some sort that would need to log the entries separately or you set it up to share the access log.

So you will need to get your platform/application logging.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.