I'm trying to monitor a user's activities on my Debian server.
I found, after Googling that the acct
package should help me log all commands and let me filter them by user.
I installed the package, some features seem to work (like the ac
command). But the most important one for me: lastcomm
shows no results:
root@myserver:~# ac
total 7.75
root@myserver:~# sa
root@myserver:~# lastcomm
root@myserver:~#
I believe it logs all activities in /var/log/account/pacct
am I right?
root@myserver:~# ls -l /var/log/account/
total 0
-rw-r----- 1 root adm 0 Aug 23 14:33 pacct
-rw-r----- 1 root adm 0 Aug 23 14:23 pacct.0
I also found sources saying it logs in /var/account/pacct
but that file/directory doesn't exist.
I'm out of ideas here, so anyone?
accton
directly? I'm having a similar problem with Debian Lenny, but when I run/usr/sbin/accton /var/log/account/pacct
, I getOperation not permitted
as root. Still trying to get to the bottom of it, but/etc/init.d/acct
masks this error message. So run manually, and see if accton kicks something similar out.