Where can I find logs regarding the user creation?

Question

I created a new user using useradd command.

I need the logs for it. Where it will be available.

Thanks in advance.

Solution

When you have created a new user look in /var/log/auth.log; the details are in there. I just created new user jim by running sudo adduser jim, for example, and this is at the end of auth.log (I have removed the date and host name from the start of the log):

 sudo: mike : TTY=pts/2 ; PWD=/home/mike ; USER=root ; COMMAND=/usr/sbin/adduser jim
 sudo: pam_unix(sudo:session): session opened for user root by mike(uid=1000)
 groupadd[1731]: group added to /etc/group: name=jim, GID=1001
 groupadd[1731]: group added to /etc/gshadow: name=jim
 groupadd[1731]: new group: name=jim, GID=1001
 useradd[1735]: new user: name=jim, UID=1001, GID=1001, home=/home/jim, shell=/bin/bash
 passwd[1742]: pam_unix(passwd:chauthtok): password changed for jim
 passwd[1742]: gkr-pam: couldn't update the login keyring password: no old password was entered chfn[1743]: changed user 'jim' information
 sudo: pam_unix(sudo:session): session closed for user root

This particular log is very useful as it records all use of elevated privileges such as creating a user, running Synaptic, etc, and also notes who has done it.

Comments

[Ankit]

what kind of logs are you looking for?

[batman]

logs specifying that a new user has been created.

[Ankit]

One way to chech if user has been created "cat /etc/passwd | grep <user>". And please try to use adduser command instead of useradd; if you're facing some issues.

[batman]

exactly what I was looking for.