Is there program to track cli linux users?

Question

I am looking for program to track users from CLI. Maybe there is currently some solution that parses log files and .bash_history files to print summary what they have done, when they have logged and etc?

Answer 1

I think what you're looking for here is the audit functionality that is part of Linux. It's entirely unpleasant to go about setting up, but this will allow you to track everything going on at level of your choice. All commands executed and their arguments, all files written to, etc. If the kernel is involved, you can hook the call.

For a "quickstart" guide to this, see http://www.novell.com/documentation/sled10/pdfdoc/auditqs_sp2/auditqs_sp2.pdf

Edit I spent a few minutes playing around with auditd and came up with this recipe for you:

auditctl -a entry,always -F arch=`arch` -F euid!=0 -S execve

That will log every program execution to the audit log (assuming auditd is running and configured). It won't log something like setting "FOO=bar" as a variable in bash, but it will log vim $FOO showing that vim was used to open bar. That will also catch anything launched in a script, called by vim, etc. I added a filter to exclude anything run by root because there are a number of automated processes that quickly cluttered things up on my system. You may wish to set that to uid / euid >= 1000 (a common starting point for user instead of system accounts).

Worthy documentation was a combination of http://www.novell.com/documentation/sled10/pdfdoc/audit_sp2/audit_sp2.pdf and man auditctl.

Answer 2

I can see 3 different ways of doing what you want:

1. Use Process accounting
2. Write a shell wrapper based on script or similar and make it the default shell
3. Or use snoopy which uses LD_PRELOAD to wrap around exec system calls and logs it to syslog

I personally prefer using process accounting for this kind of activity monitoring. It is also the one that is the most similar to what you are looking for (commands summary, login summary...).