Re: Using script(1) to log all user sessions

[Jesper Dahl Nyerup <nyerup@one.com>]

[-- Attachment #1: Type: text/plain, Size: 1616 bytes --]

On Apr 29  12:42, Karel Zak wrote:
> On Tue, Apr 29, 2014 at 12:00:28PM +0200, Jesper Dahl Nyerup wrote:
> > > >1. Adding a daemon next to script(1) and scriptreplay(1), eg.
> > > >scriptcollect(1), to be in the receiving end of the traffic, [...]
> > > 
> > > I'm unsure about this bit. It may be needed. Perhaps a transfer
> > > after the session finishes also works.
> > 
> > We also considered that, but we keep running in to theoretical corner
> > cases where this could end up being a problem - logging in on systems
> > with filled up mountpoints, securing the transcript even if the system
> > crashes, and so on.
> 
> You don't have to transfer the logs after finished session, but in
> small segments (script(1) only add new entries to the file). The same
> idea uses large databases for on-line backups
> (http://www.postgresql.org/docs/8.1/static/backup-online.html)

Good idea. But then we might as well pipe the output directly to some
rsh, avoiding the data to touch storage in the first place.

> The another (IMHO the best) possibility is to log into systemd journal, 
> it supports all necessary advantages. See
> 
>   http://www.freedesktop.org/software/systemd/man/sd-journal.html
> 
> for example sd_journal_stream_fd(). I'm not sure, but it's probably
> already possible to somehow mirror the journal over network or log to
> remote machine.

That's a good idea – we'll look into that. Sadly some of the systems
where we'd want this won't be running systemd for the next few years.

Yours,
-- 
Jesper Dahl Nyerup
Systems Engineer
One.com, nyerup@one.com

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 198 bytes --]