What are the commands for seeing Successful and Unsuccessful login events in Ubuntu 14.04.5?
aureport -au -i --success and
aureport -au -i --failed , but I don't know what the code 133, 129 etc. mean there?
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It only takes a minute to sign up.Sign up to join this community
The application you are using is fine for checking those.
aureport comes in the
auditd package and is not installed by default.
The columns in the report as as follows:
date time acct host term exe success event
Showing on my system if I run it without the
--failed it will show all:
terrance@terrance-ubuntu:~$ sudo aureport -au -i [sudo] password for terrance: Authentication Report ============================================ # date time acct host term exe success event ============================================ 1. 11/02/2017 16:37:45 terrance ? /dev/pts/2 /usr/bin/sudo yes 90 2. 11/02/2017 16:39:14 terrance ? /dev/pts/2 /usr/bin/sudo yes 243
success column is what shows if my login was successful or not. As we can see on this one, both attempts at logging in were successful (yes). The number on the last part of each line is just the
event number at which it happened. These numbers can be ignored. It is all the information before it that is important.
As suggested by @MichaelBay, I am reposting this as an answer. See the comments on the original post for the full conversation.
I suggest a modification to the solution proposed by @Terrance. First, failed attempts don't use "failed"; they use "failure". Second, using "session opened" will return more than just user sessions.
If you use
cat /var/log/auth.log | grep lightdm:auth, you will get both successful and failed attempts. This assumes you are not interested in ssh/tty logins. To get successful ones only,
cat /var/log/auth.log | grep "lightdm:auth): r". For failed ones only,
cat /var/log/auth.log | grep "lightdm:auth): a".