Tools to monitor users activity on Linux/Unix servers

Question

Is there any specific open source tool which can be used to monitor what users are doing on linux system. I have multiple servers and with access to some users on them. I want to monitor which user ran which commands at what time. I want it to be monitored from Centralized server. I know about tripwire,sysstat. But those are not full filling my requirements.

Please suggest.

Thanks Ramesh

Answer 1

Check OSSEC,

It can do file integrity checks, besides it can monitor syslog/audit.log and forward it to centralize OSSEC server, and if you write correct rules even notify you when user runs something wrong. (or block this user/ip)

Answer 2

Linux comes with the auditd system. It allows the monitoring of what you require. Look at this question.

And like iscsi said, you could set up log forwarding to your central server.

Answer 3

Just setup audit log forwarding.