Getting Instance Login Logs

Recent Pages

Getting Instance Login Logs

Last updated: 2024-01-06 17:38:11

Overview
This document describes how to obtain user login records of a CVM instance.
Directions
Linux instances
Windows instances
Note: 
This document uses a Linux instance on TencentOS Server 3.1 (TK4) as an example. As the steps may vary by operating system, proceed based on the actual conditions.
1. Log in to the Linux instance by using Web Shell.
2. You can view the following user login information as needed:
Note: 
User login logs are usually stored in the /var/run/utmp, /var/log/wtmp, /var/log/btmp, and /var/log/lastlog files.
Run the who command to view the information of the currently logged-in user in the /var/run/utmp file. The returned result is as follows:
﻿
﻿
Run the w command to view the username of the currently logged-in user and display the currently executed tasks of the user in the /var/run/utmp file. The returned result is as follows:
﻿
﻿
Run the users command to view the username of the currently logged-in user in the /var/run/utmp file. The returned result is as follows:
﻿
﻿
Run the last command to view the information of the currently and historically logged-in users in the /var/log/wtmp file. The returned result is as follows:
﻿
﻿
Run the lastb command to view the information of all the users who failed to log in to the system in the /var/log/btmp file. The returned result is as follows:
﻿
﻿
Run the lastlog command to view the last user login information in the /var/log/lastlog file. The returned result is as follows:
﻿
﻿
Run the cat /var/log/secure command to view the login information. The returned result is as follows:
﻿
﻿
Note: 
This document uses a Windows instance on Windows Server 2012 R2 English as an example. As the steps may vary by operating system, proceed based on the actual conditions.
1. Log in to the Windows instance by using WebRDP.
2. On the desktop, click 
﻿
 to open Server Manager.
3. In the Server Manager window, select Tools > Event Viewer in the top-right corner.
4. In the Event Viewer pop-up window, select Windows Logs > Security on the left and click Filter Current Log on the right.
5. In the Filter Current Log pop-up window, enter 4648 in <All Event IDs> and click OK.
6. In the Event Viewer window, double-click the logs that meet the filters.
7. In the Event Property pop-up window, click Details to view the client name and address as well as event recording time.
﻿