Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any specific open source tool which can be used to monitor what users are doing on linux system. I have multiple servers and with access to some users on them. I want to monitor which user ran which commands at what time. I want it to be monitored from Centralized server. I know about tripwire,sysstat. But those are not full filling my requirements.

Please suggest.

Thanks Ramesh

share|improve this question
up vote 1 down vote accepted

Check OSSEC,

It can do file integrity checks, besides it can monitor syslog/audit.log and forward it to centralize OSSEC server, and if you write correct rules even notify you when user runs something wrong. (or block this user/ip)

share|improve this answer
can we track from which ip which user is connected and what he has done ? – kapil das Feb 26 '14 at 15:22

Linux comes with the auditd system. It allows the monitoring of what you require. Look at this question.

And like iscsi said, you could set up log forwarding to your central server.

share|improve this answer

Just setup audit log forwarding.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.