EC2 and login logging

Question

I have set up several EC2 instances and intend to give multiple users access to them via SSH. Is there any file on the server that monitors who logs in and when?

Any help greatly appreciated.

Max.

Answer 1

None of the suggested answers here (except the last command) applied on Amazon Linux. I found SSH attempts and logins, as well as privilege escalations, in /var/log/secure.

Answer 2

In addition to the auth log Daniel mentioned, assuming you're using Linux on your EC2 instance (which is likely), see:

• the last(1) command, which reads /var/log/utmp
• the utmp(5) file formats and the getutent() C function.