I am looking for program to track users from CLI. Maybe there is currently some solution that parses log files and .bash_history files to print summary what they have done, when they have logged and etc?
locked by HopelessN00b Jan 23 '15 at 14:22
This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.
closed as off-topic by HopelessN00b Jan 23 '15 at 12:53
This question appears to be off-topic. The users who voted to close gave this specific reason:
I can see 3 different ways of doing what you want:
I personally prefer using process accounting for this kind of activity monitoring. It is also the one that is the most similar to what you are looking for (commands summary, login summary...).
I think what you're looking for here is the audit functionality that is part of Linux. It's entirely unpleasant to go about setting up, but this will allow you to track everything going on at level of your choice. All commands executed and their arguments, all files written to, etc. If the kernel is involved, you can hook the call.
For a "quickstart" guide to this, see http://www.novell.com/documentation/sled10/pdfdoc/auditqs_sp2/auditqs_sp2.pdf
Edit I spent a few minutes playing around with auditd and came up with this recipe for you:
That will log every program execution to the audit log (assuming auditd is running and configured). It won't log something like setting "FOO=bar" as a variable in bash, but it will log
Worthy documentation was a combination of http://www.novell.com/documentation/sled10/pdfdoc/audit_sp2/audit_sp2.pdf and