# Track administrators' login and logout **URL:** \ **Category:** SLES Configure-Administer\ **Created:** [October 24, 2011, 3:36pm UTC](https://forums.suse.com/t/track-administrators-login-and-logout/21844 "2011-10-24T15:36:02Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![System1](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@System1](https://forums.suse.com/u/System1)\ **Post date:** [October 24, 2011, 3:36pm UTC](https://forums.suse.com/t/track-administrators-login-and-logout/21844/1 "2011-10-24T15:36:02Z")
Hi I need to register the administrators’ login and logout from my SLES 11 SP1 server. In /var/log/messages I see the login from ssh, but the logout is missing. Moreover the login-logout with VNC is not logged. It is possible to activate the login-logout registration with ssh and VNC? Thank you Marco ## – mvisconti mvisconti’s Profile: [http://forums.novell.com/member.php?userid=97561](http://forums.novell.com/member.php?userid=97561) View this thread: [http://forums.novell.com/showthread.php?t=447223](http://forums.novell.com/showthread.php?t=447223) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [October 26, 2011, 10:56am UTC](https://forums.suse.com/t/track-administrators-login-and-logout/21844/2 "2011-10-26T10:56:01Z")
Hi The output from the “last” command shows you the login and the logout time. Is this what you’re searching? Kind regards, Tom ## – amo\_vzug amo\_vzug’s Profile: [http://forums.novell.com/member.php?userid=25342](http://forums.novell.com/member.php?userid=25342) View this thread: [http://forums.novell.com/showthread.php?t=447223](http://forums.novell.com/showthread.php?t=447223) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [October 26, 2011, 1:26pm UTC](https://forums.suse.com/t/track-administrators-login-and-logout/21844/3 "2011-10-26T13:26:02Z")
amo\_vzug;2148896 Wrote:[color=blue] > Hi > > The output from the “last” command shows you the login and the logout > time. Is this what you’re searching? > Kind regards, > Tom[/color] Thanks for the answer. I need a way to register the login and logout in a log file using the syslog-ng. With the default configuration, only the login with ssh is logged. Regards Marco ## – mvisconti mvisconti’s Profile: [http://forums.novell.com/member.php?userid=97561](http://forums.novell.com/member.php?userid=97561) View this thread: [http://forums.novell.com/showthread.php?t=447223](http://forums.novell.com/showthread.php?t=447223) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [October 26, 2011, 1:56pm UTC](https://forums.suse.com/t/track-administrators-login-and-logout/21844/4 "2011-10-26T13:56:01Z")
mvisconti;2148950 Wrote:[color=blue] > Thanks for the answer. > I need a way to register the login and logout in a log file using the > syslog-ng. With the default configuration, only the login with ssh is > logged. > > Regards > Marco[/color] This might help but not sure since I have not tried it: [http://www.suse.com/documentation/sled10/pdfdoc/auditqs\_sp2/auditqs\_sp2.pdf](http://www.suse.com/documentation/sled10/pdfdoc/auditqs_sp2/auditqs_sp2.pdf) Thomas ## – [http://thsundel.blogspot.com/](http://thsundel.blogspot.com/) thsundel’s Profile: [http://forums.novell.com/member.php?userid=128](http://forums.novell.com/member.php?userid=128) View this thread: [http://forums.novell.com/showthread.php?t=447223](http://forums.novell.com/showthread.php?t=447223) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [October 26, 2011, 2:06pm UTC](https://forums.suse.com/t/track-administrators-login-and-logout/21844/5 "2011-10-26T14:06:01Z")
thsundel;2148967 Wrote:[color=blue] > This might help but not sure since I have not tried it: > [http://www.suse.com/documentation/sled10/pdfdoc/auditqs\_sp2/auditqs\_sp2.pdf](http://www.suse.com/documentation/sled10/pdfdoc/auditqs_sp2/auditqs_sp2.pdf) > > Thomas[/color] And here is for SLES11: [http://www.suse.com/documentation/sles11/pdfdoc/art\_auditquick/art\_auditquick.pdf](http://www.suse.com/documentation/sles11/pdfdoc/art_auditquick/art_auditquick.pdf) Thomas ## – [http://thsundel.blogspot.com/](http://thsundel.blogspot.com/) thsundel’s Profile: [http://forums.novell.com/member.php?userid=128](http://forums.novell.com/member.php?userid=128) View this thread: [http://forums.novell.com/showthread.php?t=447223](http://forums.novell.com/showthread.php?t=447223) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [October 26, 2011, 2:36pm UTC](https://forums.suse.com/t/track-administrators-login-and-logout/21844/6 "2011-10-26T14:36:02Z")
You can increase the logging-information in the file /etc/ssh/sshd\_config from “LogLevel INFO” (Default) to “LogLevel VERBOSE”. This gives you the following entries in /var/log/messages: ## Code: Oct 26 13:23:29 server1 sshd[19058]: Connection from 99.99.99.99 port 50536 Oct 26 13:23:30 server1 sshd[19058]: Accepted keyboard-interactive/pam for user123 from 99.99.99.99 port 50536 ssh2 Oct 26 13:23:32 server1 sshd[19058]: Received disconnect from 99.99.99.99: 11: disconnected by user * * * With this information, you can create your own syslog-ng-filter (match-tag) to redirect login-/disconnect-messages to a certain file. Regards, Tom ## – amo\_vzug amo\_vzug’s Profile: [http://forums.novell.com/member.php?userid=25342](http://forums.novell.com/member.php?userid=25342) View this thread: [http://forums.novell.com/showthread.php?t=447223](http://forums.novell.com/showthread.php?t=447223) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [October 26, 2011, 4:36pm UTC](https://forums.suse.com/t/track-administrators-login-and-logout/21844/7 "2011-10-26T16:36:02Z")
amo\_vzug;2148974 Wrote:[color=blue] > You can increase the logging-information in the file > /etc/ssh/sshd\_config from > “LogLevel INFO” (Default) to “LogLevel VERBOSE”. This gives you the > following entries in /var/log/messages: > [color=green] > > > [/color][/color] > > Code: > > --------------------[color=blue][color=green] > > [/color] > > Oct 26 13:23:29 server1 sshd[19058]: Connection from 99.99.99.99 port 50536 > > Oct 26 13:23:30 server1 sshd[19058]: Accepted keyboard-interactive/pam for user123 from 99.99.99.99 port 50536 ssh2 > > Oct 26 13:23:32 server1 sshd[19058]: Received disconnect from 99.99.99.99: 11: disconnected by user > > [/color] > > --------------------[color=blue][color=green] > > [/color] > > With this information, you can create your own syslog-ng-filter > (match-tag) to redirect login-/disconnect-messages to a certain file. > Regards, > Tom[/color] Many thanks! Last question. It is possible to log the login and logout with VNC in the same way? When I connect with vncviewer, I don’t see any message in the log file (except error messages). Regards Marco ## – mvisconti mvisconti’s Profile: [http://forums.novell.com/member.php?userid=97561](http://forums.novell.com/member.php?userid=97561) View this thread: [http://forums.novell.com/showthread.php?t=447223](http://forums.novell.com/showthread.php?t=447223) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [October 28, 2011, 12:46pm UTC](https://forums.suse.com/t/track-administrators-login-and-logout/21844/8 "2011-10-28T12:46:02Z")
mvisconti;2149023 Wrote:[color=blue] > Many thanks! > Last question. It is possible to log the login and logout with VNC in > the same way? When I connect with vncviewer, I don’t see any message in > the log file (except error messages). > > Regards > Marco[/color] Maybe I found a solution. The VNC connection is logged by xinetd, thus I must modify /etc/xinetd.conf Thanks to all for the support. Marco ## – mvisconti mvisconti’s Profile: [http://forums.novell.com/member.php?userid=97561](http://forums.novell.com/member.php?userid=97561) View this thread: [http://forums.novell.com/showthread.php?t=447223](http://forums.novell.com/showthread.php?t=447223) ---
**Author:** ![rosario\_mattera](https://avatars.discourse-cdn.com/v4/letter/r/a88e4f/32.png) [@rosario\_mattera](https://forums.suse.com/u/rosario_mattera)\ **Post date:** [October 4, 2017, 4:09pm UTC](https://forums.suse.com/t/track-administrators-login-and-logout/21844/9 "2017-10-04T16:09:32Z")
Hi, I know this is a very old thread but I’m experiencing the same issue described here, I mean that the /var/log/messages file doesn’t contain any information about the logoff of the user but just only the login actitivity. Changing the log level to VERBOSE doesn’t resolve the problem. Could you suggest something else to try? Regards, Ros ---
**Author:** ![malcolmlewis](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/malcolmlewis/32/11375_2.png) [@malcolmlewis](https://forums.suse.com/u/malcolmlewis)\ **Post date:** [October 4, 2017, 4:19pm UTC](https://forums.suse.com/t/track-administrators-login-and-logout/21844/10 "2017-10-04T16:19:11Z")
[QUOTE=rosario\_mattera;39789]Hi, I know this is a very old thread but I’m experiencing the same issue described here, I mean that the /var/log/messages file doesn’t contain any information about the logoff of the user but just only the login actitivity. Changing the log level to VERBOSE doesn’t resolve the problem. Could you suggest something else to try? Regards, Ros[/QUOTE] Hi A very old thread 😉 Please start a new thread (add a prefix of the OS in use, potential newer tools etc) and the specific things you want to log.