Audit a user logins on Linux server

[Hanry Zhou]

If I wanted to keep track of a user's logins and also what directories he/she has gone through, what steps should I go through for this purpose?

My understanding is all activites can be stored in "messages" file, and I just need to somehow enabled log configurations. 

Thanks!

[avd437 · Accepted solution]

You have to enable auditing 

# vim /etc/audit/rules.d/audit.rules - mention your rules here

# systemctl restart auditd.service - start the service

# cat /var/log/audit/audit.log - logs location will be here