[role="xpack"]

experimental[]

This is the `login` dataset of the system module.

[float]
=== Implementation

The `login` dataset is implemented for Linux only.

On Linux, the dataset reads the https://en.wikipedia.org/wiki/Utmp[utmp] files
that keep track of logins and logouts to the system. They are usually located
at `/var/log/wtmp` (successful logins) and `/var/log/btmp` (failed logins).

The file patterns used to locate the files can be configured using
`login.wtmp_file_pattern` and `login.btmp_file_pattern`. By default,
both the current files and any rotated files (e.g. `wtmp.1`, `wtmp.2`)
are read.

utmp files are binary, but you can display their contents using the
`utmpdump` utility.

[float]
==== Example dashboard

The dataset comes with a sample dashboard:

[role="screenshot"]
image:./images/auditbeat-system-login-dashboard.png[Auditbeat System Login Dashboard]
