Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm want to get some logs from my server, but not general logs like syslog that gives me a lot of random logs. I want to know how I can get logs of things like logins(with time, IP and username), commands that the user ran, process running at the time and things like this.

share|improve this question

closed as not a real question by womble, John Gardeniers, Scott Pack, Michael Hampton, rnxrx Aug 23 '12 at 16:56

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers 3

For logins: look at the last command.

For what commands they ran: look at the lastcomm command. Additionally, any privileged command run with sudo will be in the system logs.

share|improve this answer
    
Is there any way to make a routine to log each command, even without using sudo? –  Nathan Campos Aug 21 '11 at 2:05
1  
as root, just run lastcomm user. In RHEL and Fedora, lastcomm is part of the "psacct" package. In Debian, it is part of the "acct" package. –  Chad Feller Aug 21 '11 at 2:13
    
I can use the last command like this: nohup last & so I can make a history file, or it has any restrictions? –  Nathan Campos Aug 21 '11 at 2:26
    
This history is already logged. last just reads /var/log/wtmp by default. If you type last -f /var/log/wtmp, you should see the same output as if you type last w/ no args. If you need to read a previous (rotated) wtmp file, just use that as an argument instead. e.g., last -f /var/log/wtmp-20110801. If you need to keep longer logs, just change your log rotation schedules. –  Chad Feller Aug 21 '11 at 2:40

To log commands run by people, you need to enable Linux Process Accounting. This should be in a package named acct (on Debian, probably something similar on redhat-based distributions), and comes in two pieces. The first is accton which is a command run at boot that tells the kernel to log everything that runs (your package should set this up for you). The other part is a collection of utilities that read the log file and print useful information from it. On Debian this includes

  • dump-acct which decodes the binary log file and dumps the data as text
  • sa which does more-or-less the same but focuses on extracting programs run.
  • lastcomm which dumps the log for a specific terminal, user, or command.

And a few others for figuring out how long people were connected. You'll need to decide what exactly you want to get from the logs, since a lot of stuff is recorded, but this site has some examples of things you can do.

share|improve this answer

What exactly are you trying to accomplish? You might want to enable the BASH-history feature and enable timestamps there. But this will not give you the processes running at a certain time.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.