1747984 Members
4928 Online
108756 Solutions
New Discussion юеВ

Tracking user activity

 
SOLVED
Go to solution
TheJuiceman
Super Advisor

Tracking user activity

Hey gang,
I need to track a particular user. I need to capture information like
- Login time
- Login location
- Activity
- Logout
Is there a way to do this in the .profile of the user? Thanks!!!
5 REPLIES 5
Bill Hassell
Honored Contributor

Re: Tracking user activity

> - Login time

last userID

> - Login location

last -R userID

(assumes "location" means IP address. Lots of luck trying to isolate down to a cubicle)

> - Activity

Activity? The easy answer is to make a copy of .sh_history (assuming ksh, POSIX sh, bash, etc). But what if the user tries to hide their tracks, like running vi and then escaping to a subshell with :!ksh (no log available). And the user can delete or edit the .sh_history, but if that happens, I would report that as suspicious behavior.

You might also try the script command but it gets messy with menu programs like swinstall or Glance. And of course, this assumes that the user just types shell commands.

> - Logout

last userID

NOTE: the last command is run at anytime, no modification of .profile needed. Note that .profile can also be modified by the user. For more detailed (and reliable) information, look at the auditing system (man 5 audit).


Bill Hassell, sysadmin
Jeeshan
Honored Contributor
Solution

Re: Tracking user activity

hi

i had posted a thread like you earlier, but didn't get not so much responses.

but you can do one thing, put the bellow lines in /etc/profile and check the results

DATE=`date +%d_%b_%o_%a_%R:%S`
DEST=`hostname`
ORI=`who -R am i | awk '{print $6}' | cut -c2- | cut -f1 -d ')'`
mkdir -p $HOME/.exrce/.sheel
HISTFILE=$HOME/.exrce/.sheel/$DATE.$DEST.$ORI.$LOGNAME.txt
export HISTFILE
HISTSIZE=16384
export HISTSIZE

enjoy!!!!
a warrior never quits
Jeeshan
Honored Contributor

Re: Tracking user activity

Or alternatively you can install and configure SUDO and forces users to use sudo.
a warrior never quits
Johnson Punniyalingam
Honored Contributor

Re: Tracking user activity

Hi Juiceman,

last -R "will show you location last login time of the user"

Are running you server in Trusted Mode

also you check in your System, Audtiing has been turn ON,

Thanks,
Johnson
Problems are common to all, but attitude makes the difference
TheJuiceman
Super Advisor

Re: Tracking user activity

ahsan...that is EXACTLY what I was looking for. Thanks very much!!!