Auditing — Who Logged In, When

Visibility into who's been there

Even on a small fleet, you should be able to answer "who logged in to this server in the last week?" The information lives in standard logs; the skill is knowing the queries.

Linux — auth.log and lastb

Successful logins go to /var/log/auth.log (or journalctl on systemd). Failed attempts also; lastb reads the bad-login database. last reads the good-login one. Combined, you see the full pattern: who, when, from where.

macOS — unified log

macOS funnels everything into the unified log. Query with log show + a predicate. Less ergonomic than Linux's text logs, but more powerful once you learn the predicate syntax. Filter by process (process == "sshd") and time window (--last 24h).

Code

Linux audit queries·bash

# Recent successful logins
last -20

# Currently logged in
w
who

# Failed login attempts (root required)
sudo lastb -20

# Failed sshd attempts (Debian/Ubuntu)
sudo grep 'Failed password' /var/log/auth.log | tail -20
sudo grep 'Invalid user' /var/log/auth.log | tail -20

# All sshd activity
sudo grep sshd /var/log/auth.log | tail -50

# Or via journalctl
sudo journalctl -u ssh --since '24 hours ago'

macOS audit queries·bash

# All sshd messages in the last hour
log show --predicate 'process == "sshd"' --last 1h

# Just successful auth in the last day
log show --predicate 'process == "sshd" && eventMessage contains "Accepted"' --last 24h

# Failed auth (sshd uses 'authentication failure')
log show --predicate 'process == "sshd" && eventMessage contains "failure"' --last 24h

Exercise

On every reachable server, run last -10 (Linux) or the macOS log query. Read every line. Can you account for every login? Anything you don't recognize — a username, a source IP, a time? That's a thread to pull. If everything looks routine, write a 10-line script that runs the query daily and emails the summary. Now you have automatic visibility.