Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Good day to you.

I know there's some variations of my question here, but they are a bit different I assure you.

We use terminal servers that our admins connect to and then establish ssh connections to other servers. We needed to audit their actions, that's why I used modified ssh daemon that logs sessions into script-format files. I've been using that patch . It has some drawbacks though. First, that patch wasn't updated for some time, I've managed to modify it to work for ssh-4.7, but openssh seriously changed in 5th version. Second, almost everybody uses GNU Screen and its control characters make session logs somewhat difficult to understand.

Then I've tried ttyrpld, but it needs kernel module and after some time it just stopped logging.

After that, pam_tty_audit, although it's easy to install and use, that project doesn't really solve my problem.

What I really need, something that logs only user input, can't be overridden and doesn't require rocket science knowledge to install and support.

share|improve this question

I'm sure you've seen it, but this question has a lot of suggestions for session logging - screen logging being possibly the best suggestion for your case. It may be necessary to slightly alter business practices to meet logging requirements, as no terminal logging software seems to exactly match (often diverse) demands.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.