How to Monitor User Login Activity
How to Monitor User Login Activity
Need to monitor user login activity on your Linux server? Want to track user logins, monitor authentication events, and detect suspicious login patterns? This guide shows you how to monitor user login activity using built-in commands and automated monitoring with Zuzia.app.
For comprehensive user activity monitoring strategies, see User Activity & Login Monitoring. For troubleshooting authentication issues, see User Authentication Failures.
Why Monitoring Login Activity Matters
User login activity indicates who accesses your server and when. When unauthorized logins occur or suspicious patterns are detected, security breaches can result, data can be compromised, and system integrity can be threatened. Monitoring login activity helps you detect unauthorized access, track user behavior, identify security threats, and maintain system security.
Method 1: View Login History
View login history to see who logged in and when:
Check Recent Logins
# View recent logins
last
# View recent logins for specific user
last username
# View failed login attempts
lastb
# View current logged-in users
who
Monitor Login Activity
# View detailed login information
w
# View login activity by user
lastlog
# Check login history with timestamps
last -F
# View login activity for today
last | grep "$(date +%b\ %d)"
Method 2: Monitor Authentication Logs
Monitor authentication logs to track login events:
View Authentication Events
# View successful logins
sudo grep "Accepted password" /var/log/auth.log
# View SSH login activity
sudo grep "Accepted" /var/log/auth.log | grep ssh
# View failed login attempts
sudo grep "Failed password" /var/log/auth.log
# View recent authentication events
sudo tail -100 /var/log/auth.log | grep -i "auth\|login"
Track Login Patterns
# Count logins by user
last | awk '{print $1}' | sort | uniq -c | sort -rn
# View logins by IP address
last | awk '{print $3}' | sort | uniq -c | sort -rn
# Check login frequency
last | awk '{print $1, $4, $5, $6}' | sort | uniq -c
Method 3: Detect Suspicious Login Activity
Detect suspicious login activity to identify security threats:
Identify Failed Login Attempts
# Count failed login attempts by IP
sudo grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn
# Count failed attempts by user
sudo grep "Failed password" /var/log/auth.log | awk '{print $9}' | sort | uniq -c | sort -rn
# View failed attempts in last hour
sudo grep "Failed password" /var/log/auth.log | grep "$(date +%b\ %d\ %H)"
# Identify brute force attempts
sudo grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | awk '$1 > 10'
Detect Unusual Login Patterns
# View logins from unusual locations
sudo grep "Accepted" /var/log/auth.log | awk '{print $11}' | sort | uniq
# Check for logins outside business hours
sudo grep "Accepted" /var/log/auth.log | awk '{if ($3 > "22:00" || $3 < "06:00") print}'
# View multiple failed attempts
sudo grep "Failed password" /var/log/auth.log | awk '{print $9, $11}' | sort | uniq -c | sort -rn
Method 4: Automated Login Activity Monitoring with Zuzia.app
Manual checks work while you are looking. To keep running them without you, Zuzia uses its agent and scheduled tasks.
How it works in Zuzia
- Install the Zuzia agent on the server with one command. CPU, RAM, disk, load and network metrics start reporting on their own, with alerts on a threshold, on drift from the server's normal, or on a disk fill-up forecast.
- Save the commands from this guide as a scheduled task and choose how often it runs, from every minute to once a year. The agent runs it on every host you pick.
- If a command fails, you get an alert right away by email, Slack, Discord, push (through your Pushover account) or SMS (through your Vonage account).
- The output of every run is kept, so you can look back at what changed. On paid plans, AI can read the output and alert you only when it spots a problem.
Setting it up
- Add the server in the Zuzia dashboard and install the agent.
- Create a scheduled task with the check commands below, then choose the hosts and how often it runs.
- Choose your notification channels. Turn on maintenance mode during planned work so it doesn't trigger alerts.
Custom Login Activity Monitoring Commands
Add these commands as scheduled tasks:
# Check failed login attempts
sudo grep "Failed password" /var/log/auth.log | tail -20
# Monitor successful logins
sudo grep "Accepted" /var/log/auth.log | tail -10
# Check for suspicious activity
sudo grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | awk '$1 > 10'
# View current logged-in users
who
Best Practices
1. Monitor Login Activity Continuously
Use Zuzia.app for continuous login activity monitoring. Set up alerts before security incidents occur. Review login logs regularly.
2. Set Appropriate Alert Thresholds
Configure alerts based on normal activity. Warning: 5-10 failed attempts per hour. Critical: 20+ failed attempts per hour.
3. Respond Quickly to Suspicious Activity
Have response procedures ready. Define escalation procedures. Prepare incident response playbooks.
Troubleshooting
Multiple Failed Login Attempts
When multiple failed attempts occur:
- Review authentication logs:
sudo grep "Failed password" /var/log/auth.log | tail -20 - Identify source IP addresses
- Block IPs if necessary:
sudo iptables -A INPUT -s IP_ADDRESS -j DROP
Unauthorized Login Detected
When unauthorized logins are detected:
- Check login history:
last | grep username - Review authentication logs:
sudo grep "Accepted" /var/log/auth.log | grep username - Disable compromised accounts if needed
FAQ
How often should I check login activity?
For production servers, check login activity every 5-10 minutes. Zuzia.app can check activity automatically and alert when suspicious patterns are detected.
What login activity should I monitor?
Monitor authentication events (logins, logouts, failures), privilege escalation (sudo, su), and user account changes. Focus on activities that indicate potential security threats.
Can Zuzia.app detect brute force attacks?
Yes, Zuzia.app can detect brute force attacks by monitoring failed login attempts, identifying multiple failures from the same IP, tracking failure patterns, and alerting when attack thresholds are exceeded.