How Do I Check the User IP address of a Remote Login?

Alarm Policies

The remote login detection function checks for remote logins into your servers in real time. HSS generates an alarm if it detects logins from locations other than the common login locations you set.

Viewing Remote Login Records on the Console

1. Log in to the management console.
2. In the upper left corner of the page, click , select a region, and choose Security > Host Security Service.
3. In the navigation pane on the left, choose Detection > Alarms, and click Server Alarms.
4. In the Event Type area, Choose Abnormal User Behavior > Abnormal logins, and click Remote Login.

Locally Viewing Remote Login Records

For Linux servers, you can view logs in /var/log/secure and /var/log/message directories, or run the last command to check whether there are abnormal login records.