我目前正在使用 gentoo 并且有以下方法可以知道何时有人登录我的服务器（实际上只有我一个人，但如果有人要获得访问权限，我想知道它）
1) 使用sec 监控日志文件
type=SingleWithScript
ptype=RegExp
pattern=Accepted keyboard-interactive/pam for ([a-z]+) from ([0-9|\.]+) port
script=/root/scripts/userLogin.pl $1 $2
desc=User Login
action=write /var/log/sec/sec.log User Login: $1 has logged in from $2
action2=write /var/log/sec/sec.log Script Failed: User Login: $1 has logged in from $2
2）脚本：
#!/usr/bin/perl -w
use Net::SMTP::TLS;
my $smtp;
if (not $smtp = Net::SMTP::TLS->new('smtp.gmail.com',
Port => 587,
User => '',
Password => '',
Debug => 1)) {
die "Could not connect to server\n";
}
$smtp->mail('');
$smtp->to('');
$smtp->data();
$smtp->datasend('To: ' . "\n");
$smtp->datasend('From: ' . "\n");
$smtp->datasend("Subject: User Login: $ARGV[0]\n");
$smtp->datasend("\n");
$smtp->datasend("$ARGV[0] has logged in from $ARGV[1]\n");
$smtp->dataend();
$smtp->quit;
但我担心我的正则表达式不够广泛。“接受的键盘交互/pam” - 登录可以生成与该格式不匹配的日志吗？
