topic Tracking user activity in Operating System - HP-UX

Tracking user activity

TheJuiceman — Mon, 02 Feb 2009 23:54:56 GMT

Hey gang,
I need to track a particular user. I need to capture information like
- Login time
- Login location
- Activity
- Logout
Is there a way to do this in the .profile of the user? Thanks!!!

Re: Tracking user activity

Bill Hassell — Tue, 03 Feb 2009 03:31:55 GMT

> - Login time

last userID

> - Login location

last -R userID

(assumes "location" means IP address. Lots of luck trying to isolate down to a cubicle)

> - Activity

Activity? The easy answer is to make a copy of .sh_history (assuming ksh, POSIX sh, bash, etc). But what if the user tries to hide their tracks, like running vi and then escaping to a subshell with :!ksh (no log available). And the user can delete or edit the .sh_history, but if that happens, I would report that as suspicious behavior.

You might also try the script command but it gets messy with menu programs like swinstall or Glance. And of course, this assumes that the user just types shell commands.

> - Logout

last userID

NOTE: the last command is run at anytime, no modification of .profile needed. Note that .profile can also be modified by the user. For more detailed (and reliable) information, look at the auditing system (man 5 audit).

Re: Tracking user activity

Jeeshan — Tue, 03 Feb 2009 03:51:45 GMT

hi

i had posted a thread like you earlier, but didn't get not so much responses.

but you can do one thing, put the bellow lines in /etc/profile and check the results

DATE=`date +%d_%b_%o_%a_%R:%S`
DEST=`hostname`
ORI=`who -R am i | awk '{print $6}' | cut -c2- | cut -f1 -d ')'`
mkdir -p $HOME/.exrce/.sheel
HISTFILE=$HOME/.exrce/.sheel/$DATE.$DEST.$ORI.$LOGNAME.txt
export HISTFILE
HISTSIZE=16384
export HISTSIZE

enjoy!!!!

Re: Tracking user activity

Jeeshan — Tue, 03 Feb 2009 03:53:51 GMT

Or alternatively you can install and configure SUDO and forces users to use sudo.

Re: Tracking user activity

Johnson Punniyalingam — Tue, 03 Feb 2009 04:04:12 GMT

Hi Juiceman,

last -R "will show you location last login time of the user"

Are running you server in Trusted Mode

also you check in your System, Audtiing has been turn ON,

Thanks,
Johnson

Re: Tracking user activity

TheJuiceman — Tue, 03 Feb 2009 05:11:10 GMT

ahsan...that is EXACTLY what I was looking for. Thanks very much!!!