Is there any specific open source tool which can be used to monitor what users are doing on linux system. I have multiple servers and with access to some users on them. I want to monitor which user ran which commands at what time. I want it to be monitored from Centralized server. I know about tripwire,sysstat. But those are not full filling my requirements.

Please suggest.

Thanks Ramesh


Check OSSEC,

It can do file integrity checks, besides it can monitor syslog/audit.log and forward it to centralize OSSEC server, and if you write correct rules even notify you when user runs something wrong. (or block this user/ip)

  • can we track from which ip which user is connected and what he has done ? – kapil das Feb 26 '14 at 15:22

Linux comes with the auditd system. It allows the monitoring of what you require. Look at this question.

And like iscsi said, you could set up log forwarding to your central server.


Just setup audit log forwarding.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.