linux-登入日志

# linux-登入日志

## 目录

[TOC]

## 概要

系统中有一些重要的痕迹日志文件，如`/var/log/wtmp`、`/var/run/utmp`、`/var/log/btmp`、`/var/log/lastlog`

## 前情

今天在做日志实验的时候发现linux大多日志通过cat或者vim命令查看是二进制乱码，后来查询了一下是因为，这些日志中保存的是系统的重要登录痕迹，包括某个用户何时登录的系统，何时退出了系统，错误登录等重要的系统信息。这些信息要是可以通过 vim 打开，就能编辑，这样痕迹信息就不准确，所以这些重要的痕迹日志，只能通过对应的命令来查看。

## 详细命令

### 1、w命令

> w 命令是显示系统中正在登录的用户信息的命令
>

查看的痕迹日志是 `/var/run/utmp`

```bash
ctccaozhe@ctccaozhe:~$ w
 14:15:10 up 9 days, 20:28,  1 user,  load average: 0.31, 0.07, 0.02
USER     TTY      来自           LOGIN@   IDLE   JCPU   PCPU WHAT
ctccaozh pts/0    10.10.10.7       14:15    5.00s  0.16s  0.02s w
ctccaozhe@ctccaozhe:~$ 
```
**第一行内容**

| 内容                           | 说明                                                         |
| ------------------------------ | ------------------------------------------------------------ |
| 14:15:10                       | 系统当前时间                                                 |
| up 9 days                      | 系统运行时间，运行了9天没关机                                |
| 1 user                         | 登入了一个用户                                               |
| load average: 0.31, 0.07, 0.02 | 系统在1分钟，5分钟，15分钟的平均负载。如果CPU是单核的，则这个数超过1就是过载，如果CPU是4核的，那数值超过4就是高负载 |

**第二行信息内容**
![](/zb_users/upload/2020/09/202009141445029289336.png)

### 2、who命令

> who 命令 和 w 命令类似，用于查看正在登录的用户，但是显示的内容更加简单，也是查看 `/var/run/utmp` 的日志

```bash
ctccaozhe@ctccaozhe:~$ who
ctccaozhe pts/0        2020-09-14 14:15 (10.10.10.7)
ctccaozhe@ctccaozhe:~$ ^C
```

### 3、last 命令

> last 命令是查看系统所有登录过的用户信息，包括正在登录的用户和之前登录过的用户。这个命令查看的是 /var/log/wtmp 痕迹日志文件

```bash
ctccaozhe@ctccaozhe:~$ last
ctccaozh pts/0        10.10.10.7       Mon Sep 14 14:15   still logged in
reboot   system boot  5.3.0-64-generic Fri Sep  4 17:47   still running
reboot   system boot  5.3.0-64-generic Fri Sep  4 12:44   still running
reboot   system boot  5.3.0-64-generic Fri Sep  4 11:47   still running
root     pts/1        10.10.10.7       Fri Sep  4 10:24 - down   (01:22)
ctccaozh pts/0        10.10.10.7       Fri Sep  4 10:23 - 11:46  (01:23)
reboot   system boot  5.3.0-64-generic Fri Sep  4 10:23 - 11:46  (01:23)
ctccaozh pts/3        10.10.10.7       Fri Sep  4 10:21 - 10:22  (00:00)
root     pts/3        10.10.10.179     Fri Sep  4 10:19 - 10:21  (00:01)
ctccaozh pts/0        10.10.10.7       Fri Sep  4 10:07 - 10:22  (00:15)
ctccaozh pts/0        10.10.10.7       Thu Sep  3 09:17 - 18:53  (09:36)
ctccaozh pts/3        10.10.10.10      Wed Sep  2 17:02 - 17:23  (00:20)
ctccaozh pts/0        10.10.10.7       Wed Sep  2 15:53 - 18:01  (02:07)
ctccaozh pts/3        10.10.10.7       Fri Aug 21 15:43 - 18:03  (02:19)
ctccaozh pts/0        10.10.10.7       Fri Aug 21 15:40 - 18:03  (02:22)
ctccaozh pts/0        10.10.10.7       Tue Aug  4 13:42 - 18:03  (04:20)
ctccaozh pts/3        10.10.10.7       Mon Aug  3 12:03 - 18:06  (06:03)
ctccaozh pts/0        10.10.10.7       Mon Aug  3 11:56 - 12:18  (00:22)
ctccaozh pts/0        10.10.10.22      Fri Jul 31 10:27 - 13:44  (03:17)
ctccaozh pts/0        10.10.10.22      Fri Jul 17 17:56 - 18:20  (00:24)
ctccaozh pts/0        10.10.10.22      Fri Jul 17 17:30 - 17:43  (00:13)
ctccaozh pts/5        10.10.10.22      Thu Jul 16 10:26 - 10:27  (00:01)
ctccaozh pts/4        10.10.10.22      Thu Jul 16 10:25 - 10:27  (00:02)
ctccaozh pts/3        10.10.10.22      Thu Jul 16 10:20 - 20:14  (09:54)
ctccaozh pts/0        10.10.10.22      Thu Jul 16 10:17 - 20:14  (09:57)
ctccaozh pts/3        10.10.10.22      Tue Jul 14 11:56 - 20:13  (08:16)
ctccaozh :0           :0               Tue Jul 14 18:59 - down  (51+15:23)
ctccaozh pts/0        10.10.10.22      Tue Jul 14 18:59 - 20:13  (01:14)
reboot   system boot  5.3.0-62-generic Tue Jul 14 11:04 - 10:23 (51+23:18)
ctccaozh pts/1        10.10.10.22      Tue Jul 14 10:54 - 11:02  (00:08)
ctccaozh :0           :0               Mon Jul 13 14:34 - down   (20:28)
ctccaozh pts/0        10.10.10.22      Mon Jul 13 09:50 - 18:12  (08:22)
reboot   system boot  5.3.0-62-generic Mon Jul 13 09:47 - 11:03 (1+01:16)
ctccaozh pts/2        10.10.10.22      Thu Jul  2 09:22 - 18:03  (08:41)
ctccaozh pts/2        10.10.10.22      Wed Jul  1 14:20 - 15:56  (01:35)
ctccaozh :0           :0               Wed Jul  1 14:11 - down  (11+19:32)
reboot   system boot  5.3.0-61-generic Wed Jul  1 14:09 - 09:44 (11+19:34)
ctccaozh :0           :0               Mon Jun 22 14:48 - down  (5+23:47)
reboot   system boot  5.3.0-59-generic Mon Jun 22 14:47 - 14:35 (5+23:47)
ctccaozh :0           :0               Mon Jun 22 10:56 - down   (03:14)
reboot   system boot  5.3.0-59-generic Mon Jun 22 10:55 - 14:10  (03:14)
ctccaozh :0           :0               Mon Jun 22 10:55 - down   (00:00)
ctccaozh :0           :0               Mon Jun 22 10:43 - 10:54  (00:11)
reboot   system boot  5.3.0-59-generic Mon Jun 22 10:41 - 10:55  (00:13)
ctccaozh :0           :0               Wed Jun 10 15:06 - crash (11+19:34)
reboot   system boot  5.0.0-13-generic Tue Jun  9 12:22 - 10:55 (12+22:33)

wtmp begins Tue Jun  9 12:22:12 2020
ctccaozhe@ctccaozhe:~$

```

### 4、lastlog 命令

> lastlog 命令是查看系统中所有用户最后一次的登录时间的命令，他查看的日志是 `/var/log/lastlog` 文件

```bash
ctccaozhe@ctccaozhe:~$ lastlog 
用户名           端口     来自             最后登陆时间
root             pts/1    10.10.10.7       五 9月  4 10:24:11 +0800 2020
daemon                                     **从未登录过**
bin                                        **从未登录过**
sys                                        **从未登录过**
sync                                       **从未登录过**
games                                      **从未登录过**
man                                        **从未登录过**
lp                                         **从未登录过**
mail                                       **从未登录过**
news                                       **从未登录过**
uucp                                       **从未登录过**
proxy                                      **从未登录过**
www-data                                   **从未登录过**
backup                                     **从未登录过**
list                                       **从未登录过**
irc                                        **从未登录过**
gnats                                      **从未登录过**
nobody                                     **从未登录过**
systemd-timesync                           **从未登录过**
systemd-network                            **从未登录过**
systemd-resolve                            **从未登录过**
messagebus                                 **从未登录过**
syslog                                     **从未登录过**
_apt                                       **从未登录过**
uuidd                                      **从未登录过**
avahi-autoipd                              **从未登录过**
usbmux                                     **从未登录过**
rtkit                                      **从未登录过**
dnsmasq                                    **从未登录过**
cups-pk-helper                             **从未登录过**
speech-dispatcher                           **从未登录过**
kernoops                                   **从未登录过**
avahi                                      **从未登录过**
saned                                      **从未登录过**
nm-openvpn                                 **从未登录过**
whoopsie                                   **从未登录过**
colord                                     **从未登录过**
hplip                                      **从未登录过**
geoclue                                    **从未登录过**
pulse                                      **从未登录过**
gnome-initial-setup                           **从未登录过**
gdm                                        **从未登录过**
ctccaozhe        pts/0    10.10.10.7       一 9月 14 14:15:05 +0800 2020
systemd-coredump                           **从未登录过**
tcpdump                                    **从未登录过**
sshd                                       **从未登录过**
zabbix                                     **从未登录过**
ctccaozhe@ctccaozhe:~$ 
```

### 5、lastb 命令

> lastb 是查看错误登录信息的，查看的是 `/var/log/btmp` 痕迹日志，需要root权限

```bash
ctccaozhe@ctccaozhe:~$ lastb
lastb: 打不开 /var/log/btmp: 权限不够
ctccaozhe@ctccaozhe:~$ sudo lastb
[sudo] ctccaozhe 的密码： 
root     ssh:notty    10.10.10.179     Fri Sep  4 10:01 - 10:01  (00:00)
root     ssh:notty    10.10.10.179     Fri Sep  4 09:59 - 09:59  (00:00)
root     ssh:notty    10.10.10.179     Fri Sep  4 09:59 - 09:59  (00:00)
         ssh:notty    10.10.10.13      Fri Sep  4 09:21 - 09:21  (00:00)
root     ssh:notty    10.10.10.10      Wed Sep  2 17:02 - 17:02  (00:00)
root     ssh:notty    10.10.10.10      Wed Sep  2 16:58 - 16:58  (00:00)
root     ssh:notty    10.10.10.10      Wed Sep  2 16:58 - 16:58  (00:00)
root     ssh:notty    10.10.10.10      Wed Sep  2 16:56 - 16:56  (00:00)
root     ssh:notty    10.10.10.10      Wed Sep  2 16:56 - 16:56  (00:00)
root     ssh:notty    10.10.10.10      Wed Sep  2 16:55 - 16:55  (00:00)
ctcaozhe ssh:notty    10.10.10.10      Wed Sep  2 16:35 - 16:35  (00:00)
ctcaozhe ssh:notty    10.10.10.10      Wed Sep  2 16:35 - 16:35  (00:00)
ctcaozhe ssh:notty    10.10.10.10      Wed Sep  2 16:34 - 16:34  (00:00)
ctcaozhe ssh:notty    10.10.10.10      Wed Sep  2 16:34 - 16:34  (00:00)
caozhe   ssh:notty    10.10.10.10      Wed Sep  2 16:34 - 16:34  (00:00)
caozhe   ssh:notty    10.10.10.10      Wed Sep  2 16:34 - 16:34  (00:00)
root     ssh:notty    10.10.10.10      Wed Sep  2 16:32 - 16:32  (00:00)
root     ssh:notty    10.10.10.10      Wed Sep  2 16:32 - 16:32  (00:00)
root     ssh:notty    10.10.10.10      Wed Sep  2 16:32 - 16:32  (00:00)

btmp begins Wed Sep  2 16:32:20 2020
ctccaozhe@ctccaozhe:~$ 
```