monitor who logged into Magea7 and who mounts what

[vmunich]

Hi everyone,

on my system with Mageia7, I would like to have the possibility to monitor who logged into the system and who mounted which data system or external drive or DVD in the last 7 days.

Is that possible ?

Which log file should i look into ?

Best,
Vincent

[doktor5000]

Who logged into the system is referring to local logins? You should be able to query this with the command last, although depending on what login manager you're using, it might not show all sessions ( see the third bullet point at https://wiki.mageia.org/en/Mageia_6_Errata#SDDM and the linked bug report )

FWIW this is logged in /var/log/wtmp and you can check the man page of wtmp for more details.

For who mounted what best look at journal

Code: Select all

journalctl -a --since="7 days ago" |grep -iE "mount|udisks"

log output which should show all mounts, although you might need to extend the grep regex depending on how the mounts happened.