Count how many times users have successfully logged into your Linux machine.

This command will display a count of successful logins to your Linux machine.

jason-H55-USB3% grep 'session opened' /var/log/auth.log | wc -l
67

This will display a count of failed login attempts to your Linux machine.

jason-H55-USB3% grep 'FAILED LOGIN' /var/log/auth.log | wc -l
3

This command will list all of the usernames with failed logins.

                                                                                                                         14-11-10  2:20PM
jason-H55-USB3% grep 'Authentication failure' /var/log/auth.log | cut -d ' ' -f 12
'jason',
'jason',
'jason',

This is how to show more fields and more information. I am listing the date, the TTY that the user was attempting to login with & their username.

jason-H55-USB3% grep 'Authentication failure' /var/log/auth.log | cut -d ' ' -f 1,2,3,12,10
Nov 10 14:13:46 '/dev/tty2' 'jason',
Nov 10 14:13:55 '/dev/tty2' 'jason',
Nov 10 14:14:03 '/dev/tty2' 'jason',

This is a another, related command, this will show the top 10 commands that you have executed on your Linux machine.

jason-H55-USB3% sed 's/^\([^ ]*\)\( .*\)/\1/' .bash_history  | sort | uniq -c | sort -rn | head -n 20
    410 sudo
    143 cd
    121 mc
    103 ssh
     99 ls
     51 ifconfig
     33 ping
     29 openvpn
     28 homer@deusexmachina:~/Videos/shots$
     28 env
     27 ps
     22 man
     22 espeak
     21 mocp
     21 cvlc
     13 firefox
     11 source
     11 cat
     10 sipcalc
     10 ffserver
2 responses to “Count how many times users have successfully logged into your Linux machine.

Leave a Reply