Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking for program to track users from CLI. Maybe there is currently some solution that parses log files and .bash_history files to print summary what they have done, when they have logged and etc?

share|improve this question
    
define "track" ? –  Sirex Aug 17 '11 at 14:29
    
possible duplicate of Proccess Accounting in Linux recommendations/considerations –  MikeyB Aug 17 '11 at 18:16
    
To know if users haven't executed programs or are in activity that could possibly damage system or compromise it's security. –  Tadas Šubonis Aug 18 '11 at 15:46

2 Answers 2

I can see 3 different ways of doing what you want:

  1. Use Process accounting
  2. Write a shell wrapper based on script or similar and make it the default shell
  3. Or use snoopy which uses LD_PRELOAD to wrap around exec system calls and logs it to syslog

I personally prefer using process accounting for this kind of activity monitoring. It is also the one that is the most similar to what you are looking for (commands summary, login summary...).

share|improve this answer

I think what you're looking for here is the audit functionality that is part of Linux. It's entirely unpleasant to go about setting up, but this will allow you to track everything going on at level of your choice. All commands executed and their arguments, all files written to, etc. If the kernel is involved, you can hook the call.

For a "quickstart" guide to this, see http://www.novell.com/documentation/sled10/pdfdoc/auditqs_sp2/auditqs_sp2.pdf

Edit I spent a few minutes playing around with auditd and came up with this recipe for you:

auditctl -a entry,always -F arch=`arch` -F euid!=0 -S execve

That will log every program execution to the audit log (assuming auditd is running and configured). It won't log something like setting "FOO=bar" as a variable in bash, but it will log vim $FOO showing that vim was used to open bar. That will also catch anything launched in a script, called by vim, etc. I added a filter to exclude anything run by root because there are a number of automated processes that quickly cluttered things up on my system. You may wish to set that to uid / euid >= 1000 (a common starting point for user instead of system accounts).

Worthy documentation was a combination of http://www.novell.com/documentation/sled10/pdfdoc/audit_sp2/audit_sp2.pdf and man auditctl.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.