rwmaillists at googlemail.com
Sun Apr 11 12:12:01 UTC 2010
On Sun, 11 Apr 2010 11:32:27 +0200
Jos Chrispijn <kernel at webrz.net> wrote:
> On 11-4-2010 9:41, Doug Hardie wrote:
> > A cheesy way to do that is to use a popen ("tail -f
> > /var/log/auth.log", "r") and then read that. It will give you every
> > login regardless of ssh, telnet etc. You could then generate the
> > emails from that. I have no idea just how resource intensive this
> > might be. You would also have to ensure it got started by rc during
> > boot._______________________________________________
> In order to find out if someone logged in, I should then first copy
> auth.log to auth2.log, and do a compare and then do the tail trick.
> Have to cron that every half a minute.
> I would like to know if there is something that is alterted on the
> moment that someone logs on thus forcing evt. your tail suggestion
tail -f *is* event driven. When a new line is appended to auth.log,
tail will output it.
You should probably use
$ tail -F -n 0 /var/log/auth.log
More information about the freebsd-questions