> For the complete documentation index, see [llms.txt](https://docs.acecloud.ai/knowledge-base/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.acecloud.ai/knowledge-base/tutorials/how-to-monitor-system-authentication-logs-on-ubuntu-20.04.md). # How to monitor system authentication logs on Ubuntu 20.04? {% embed url="" %} ### Overview Monitoring the system once your users have been configured is a crucial part of authentication management. You can follow along on any current Linux distribution while we explore these ideas on a server running Ubuntu 20.04. ### **Prerequisites** There are certain prerequisites that need to be met before you begin. * Ubuntu version 20.04 or any other Linux equipped system * A regular user (non-root) having Sudo privileges * Internet connection ### Examine the Authentication Attempts All authentication attempts are recorded by modern Linux systems in a separate file. You can find it at /var/log/auth.log. Use the following command to view this file. ``` sudo less /var/log/auth.log ```

Use **q** to quit once you are done viewing the file. ### Using the Command: last Often, just the most recent login attempts will be of interest to you. They are visible using the **last** command: ``` last ```

This gives access to a formatted version of the information stored in the /etc/log/wtmp file. A list of values separated by hyphens represents the total amount of time users spent logged into the system during other, already closed sessions. ### Using the Command: lastlog You can also use the lastlog command to see when each user last logged into the system. It displays the username, port and the last login time of the user. You can get this information by opening /etc/log/lastlog**.** It is then sorted by entries in the /etc/passwd file: ``` lastlog ```

You can see the last login time of each system user. ### Conclusion It's important to understand where the system stores login information so you can track changes to your server that don't match your usage. User authentication in Linux is a relatively flexible area of system administration. With widely available tools, there are many ways to achieve the same goal. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.acecloud.ai/knowledge-base/tutorials/how-to-monitor-system-authentication-logs-on-ubuntu-20.04.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.