Re: [OT] Linux user logging

["Erik Wikström" <eriwik@itstud.chalmers.se>]

On Fri, Jul 16, 2004 at 09:49:13AM -0500, Aleksandar Milivojevic wrote:

> Michael Gale wrote:
> >Hello,
> >
> >	I know this is not a netfilter question but I was wondering if any 
> >	one knows of a way to log all user activity. So if a
> >user logs in via a SSH connection I would like to log all user activity. 
> >What files the view or alter and any other
> >commands ?
> 
> Yup, completely OT for this mailing list...
> 
> What you are looking for is called auditing.  There are some projects 
> for implementing it on Linux, but AFAIK nothing final and stable.  If I 
> understood it correctly (and I might be completely wrong here), the 
> major problem is that core group of Linux kernel developers is reluctant 
> in putting appropriate auditing hooks into kernel (not even as an 
> compile time option for those that need it), for whatever reason.
> 
> Note that good auditing is not trivial to configure, and depending on 
> what you want to log, auditing can produce *huge* log files.

You might be interested in looking at BSD Process Accounting, which can
be found under General Setup in the kernel configuration. It should give
you information about which processed a user run and such things.

I also have a option called Enable Auditing (also under General Setup)
in my 2.6.7 kernel. Both of these probably need some userland tools but
I'm sure a search can give you what you need.

--
Erik Wikström