What command on SSH does display the SSH access logs or something similar.
Someone changed my root pass, its back to default and i want to check the logs or what or who changed the root, ip address or anything related to SSH activity.
Regards

"grep sshd /var/log/secure | more" (without quotes)
Will display the file on screen.

"pico /var/log/secure" (without quotes)
Will display the file itself.

your the best
thanks

Although this is already answered.

/var/log will store most of your logs

secure is the one you want to see who logged in/failed logins etc

the history command will show the last commands executed by the current user.

Alternativly if you are using the bash shell /home/username/.bash_history will also show the same as history output.

last -a

will show the past people to login.

actually, if you upgrade to bash 3, you can enable history logging to a file, which is kinda nice for a record..