- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - HP-UX
- >
- Tracking user activity
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-02-2009 03:54 PM
тАО02-02-2009 03:54 PM
I need to track a particular user. I need to capture information like
- Login time
- Login location
- Activity
- Logout
Is there a way to do this in the .profile of the user? Thanks!!!
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-02-2009 07:31 PM
тАО02-02-2009 07:31 PM
Re: Tracking user activity
last userID
> - Login location
last -R userID
(assumes "location" means IP address. Lots of luck trying to isolate down to a cubicle)
> - Activity
Activity? The easy answer is to make a copy of .sh_history (assuming ksh, POSIX sh, bash, etc). But what if the user tries to hide their tracks, like running vi and then escaping to a subshell with :!ksh (no log available). And the user can delete or edit the .sh_history, but if that happens, I would report that as suspicious behavior.
You might also try the script command but it gets messy with menu programs like swinstall or Glance. And of course, this assumes that the user just types shell commands.
> - Logout
last userID
NOTE: the last command is run at anytime, no modification of .profile needed. Note that .profile can also be modified by the user. For more detailed (and reliable) information, look at the auditing system (man 5 audit).
Bill Hassell, sysadmin
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-02-2009 07:51 PM
тАО02-02-2009 07:51 PM
Solutioni had posted a thread like you earlier, but didn't get not so much responses.
but you can do one thing, put the bellow lines in /etc/profile and check the results
DATE=`date +%d_%b_%o_%a_%R:%S`
DEST=`hostname`
ORI=`who -R am i | awk '{print $6}' | cut -c2- | cut -f1 -d ')'`
mkdir -p $HOME/.exrce/.sheel
HISTFILE=$HOME/.exrce/.sheel/$DATE.$DEST.$ORI.$LOGNAME.txt
export HISTFILE
HISTSIZE=16384
export HISTSIZE
enjoy!!!!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-02-2009 07:53 PM
тАО02-02-2009 07:53 PM
Re: Tracking user activity
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-02-2009 08:04 PM
тАО02-02-2009 08:04 PM
Re: Tracking user activity
last -R "will show you location last login time of the user"
Are running you server in Trusted Mode
also you check in your System, Audtiing has been turn ON,
Thanks,
Johnson
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО02-02-2009 09:11 PM
тАО02-02-2009 09:11 PM