Re: [OT] Linux user logging

[Aleksandar Milivojevic <amilivojevic@pbl.ca>]

Michael Gale wrote:
> Hello,
> 
> 	I know this is not a netfilter question but I was wondering if any one knows of a way to log all user activity. So if a
> user logs in via a SSH connection I would like to log all user activity. What files the view or alter and any other
> commands ?

Yup, completely OT for this mailing list...

What you are looking for is called auditing.  There are some projects 
for implementing it on Linux, but AFAIK nothing final and stable.  If I 
understood it correctly (and I might be completely wrong here), the 
major problem is that core group of Linux kernel developers is reluctant 
in putting appropriate auditing hooks into kernel (not even as an 
compile time option for those that need it), for whatever reason.

Note that good auditing is not trivial to configure, and depending on 
what you want to log, auditing can produce *huge* log files.

-- 
Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7