Server login Detail

[Harishmehra79]

Hello Mates,

We are having one HP DL 360 Gen 9 server located in Airtel Nigeria network. someone misused our server and we would like to know do our server maintain any login detail/time that we can see and identify when it happen and how it happen. this is really urgent because our work is on stake due to this issue. We need to know how person come to our system because we access this server remotely for that you need to come to my office vpn then cloud then you can get the access after putting username and passowod. but in this case we are not able to see anything on our local system and cloud but person did the access so we can your support here.

i am available on skype for any further suggestion and discussion ( harish.mehra2)

Thanks in advance.

Regards,

Harish Mehra

[Dennis Handly]

What OS version are you running?  Have you looked at those logs?

[Harishmehra79]

We are using 7.2 centos 64bits. could you please guide us where we can find these logs?

[Dennis Handly]

Those logs should be in /var/log/, including auth.log there.