I have a server that a few people log in to but I realized that when checking with last and lastlog that it doesn't list ssh done with VSCode but it works for people who use the terminal. How can I see when people have logged in via VSCode similar to last/lastlog?
1 Answer
Looking at your comment above, and seeing that you can determine from time-stamps on user files when they connected you should be able to create a systemd-service that utilises an inotifywatch on /home and logs all write-close access to said files (directories?) to a file under /var/log yourself...
[edit]
As an afterthought - it's possible that VScode uses sftp under the hood, which doesn't get logged in many distros by default. If your /etc/ssh/sshd_config doesn't have a line like the following, try adding that and restart sshd (tweak the level if INFO is too garrulous):
Subsystem sftp internal-sftp -f AUTH -l INFO
/var/log/auth.log, but I don't think there's a ready-made tool (other than grep/sed/awk) to interrogate that, so not really similar to last/lastlog.<user>/.vscode-serverwas modified. Which is modified every time they login./etc/ssh/sshd_configin your question? I couldn't find anything about VScode, but it appears that many distros don't logsftpconnections byh default. It might be that you just need to enable logging forsftpexplicitly ... I'll add the respective line to my answer below.