Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to monitor all user's activity in my server.

Even when the user executes a shell command from some editor like vim I want to see them in the log file.

I have checked the tool acct but it is not listing the complete commands. (Please correct me if I have missed some options which does already).

Which Linux tool I should be looking at to solve this problem?

share|improve this question
    
. man script(1) –  adaptr Nov 30 '11 at 14:03
    

3 Answers 3

up vote 13 down vote accepted

Add this line to your pam config responsible for logins (its system-auth on redhat based distros)

session    required     pam_tty_audit.so enable=*

To find out what was done, you can use.

ausearch -ts <some_timestamp> -m tty -i

This produces an output like this:

 type=TTY msg=audit(11/30/2011 15:38:39.178:12763684) : tty pid=32377 uid=root
 auid=matthew major=136 minor=2 comm=bash data=<up>,<ret>

The only downside to this is is can be a little bit difficult to read, but it is much better than most proposed solutions since in theory it could be used to record an entire session, warts n all.

Edit: Oh and you can use aureport to generate a list that can be more helpful.

# aureport --tty
...
12. 11/30/2011 15:50:54 12764042 501 ? 4294967295 bash "d",<^D>
13. 11/30/2011 15:52:30 12764112 501 ? 4294967295 bash "aureport --ty",<ret>
14. 11/30/2011 15:52:31 12764114 501 ? 4294967295 bash <up>,<left>,<left>,"t",<ret>
share|improve this answer
    
Thanks for the details. I am using Ubuntu 10.04 LTS When I check the folder /lib/security/ the module is not present but there is a man page present for that module. I think I have hit this bug bugs.launchpad.net/ubuntu/+source/pam/+bug/588547 Is there any other way I can install that module ? –  Supratik Dec 1 '11 at 7:56
    
The bug report suggests a fix and update was distributed. –  Matthew Ife Dec 2 '11 at 10:54
    
@Mlfe I compiled the PAM source code and copied the .so file in /lib/security/ and it worked. Thanks again. –  Supratik Dec 4 '11 at 9:02
    
Note that pam_tty_audit.so will capture all interactions, including passwords –  Cameron Kerr Sep 17 at 0:09

The best solution to your problem would be Linux' built-in audit system. Use man 8 auditd or check this page for more information: http://linux.die.net/man/8/auditd.

Also, you can check this tutorial - while it is slightly out of the scope of your question, it shows how the audit system works.

share|improve this answer

here's a magic solution : http://www.cyberciti.biz/tips/howto-log-user-activity-using-process-accounting.html

  • yum install psacct (redhat)
  • sudo apt-get install acct

you ca display statistic about user commands/connection etc..

List all commands invoked by a given user ...

Search the accounting logs by command name: $ lastcomm rm $ lastcomm passwd

and so on, for more informations please visit the above link ..

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.