Unix security

spiers · July 22, 2009, 10:58am

Is there anyway to trace where a user has logged in from.

Someone this morning deleted some data but I only have the following info from the last command

cromread pts/ta Wed Jul 22 06:55 - 06:57 (00:02)
cromread pts/ta Wed Jul 22 06:43 - 06:46 (00:02)
cromread pts/ta Wed Jul 22 05:58 - 06:02 (00:04)
cromread pts/ta Wed Jul 22 05:37 - 05:42 (00:04)
cromread pts/ta Wed Jul 22 05:27 - 05:30 (00:03)

methyl · July 22, 2009, 12:46pm

last -R

laxmikant · July 28, 2009, 3:29am

use
last -a --> it will o/p hostname in last column.

jim_mcnamara · July 28, 2009, 10:36am

POSIX does not specify standards for the last command. One of the above answers will probably work for you.

Next time consider telling us your OS.