Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am looking for program to track users from CLI. Maybe there is currently some solution that parses log files and .bash_history files to print summary what they have done, when they have logged and etc?

share

locked by HopelessN00b Jan 23 at 14:22

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

put on hold as off-topic by HopelessN00b Jan 23 at 12:53

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

    
define "track" ? –  Sirex Aug 17 '11 at 14:29
    
possible duplicate of Proccess Accounting in Linux recommendations/considerations –  MikeyB Aug 17 '11 at 18:16
    
To know if users haven't executed programs or are in activity that could possibly damage system or compromise it's security. –  Tadas Šubonis Aug 18 '11 at 15:46

2 Answers 2

I can see 3 different ways of doing what you want:

  1. Use Process accounting
  2. Write a shell wrapper based on script or similar and make it the default shell
  3. Or use snoopy which uses LD_PRELOAD to wrap around exec system calls and logs it to syslog

I personally prefer using process accounting for this kind of activity monitoring. It is also the one that is the most similar to what you are looking for (commands summary, login summary...).

share

I think what you're looking for here is the audit functionality that is part of Linux. It's entirely unpleasant to go about setting up, but this will allow you to track everything going on at level of your choice. All commands executed and their arguments, all files written to, etc. If the kernel is involved, you can hook the call.

For a "quickstart" guide to this, see http://www.novell.com/documentation/sled10/pdfdoc/auditqs_sp2/auditqs_sp2.pdf

Edit I spent a few minutes playing around with auditd and came up with this recipe for you:

auditctl -a entry,always -F arch=`arch` -F euid!=0 -S execve

That will log every program execution to the audit log (assuming auditd is running and configured). It won't log something like setting "FOO=bar" as a variable in bash, but it will log vim $FOO showing that vim was used to open bar. That will also catch anything launched in a script, called by vim, etc. I added a filter to exclude anything run by root because there are a number of automated processes that quickly cluttered things up on my system. You may wish to set that to uid / euid >= 1000 (a common starting point for user instead of system accounts).

Worthy documentation was a combination of http://www.novell.com/documentation/sled10/pdfdoc/audit_sp2/audit_sp2.pdf and man auditctl.

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.