Re: Audit a user logins on Linux server

You have to enable auditing 

# vim /etc/audit/rules.d/audit.rules - mention your rules here

# systemctl restart auditd.service - start the service

# cat /var/log/audit/audit.log - logs location will be here