Monitoring user's act

[FireDragon.Xu]

Hi,all

I want to wirte a script to Monitoring user's act,including every command was the user used until log out.

I hope that script can generate or redirect to a file as i specified.

Which expert can help me to write it?

Thanks.

Jackie Xu

[Santosh Nair_1]

Why not just set the user's HISTFILE variable and then go through the user's history. The HISTFILE should contain all the commands run by the user.

Hope this helps.

-Santosh

[FireDragon.Xu]

hello,Santosh

How to do,please?

Jacie Xu

[Santosh Nair_1]

This is simple...just modify /etc/profile to include the following line:

export HISTFILE=/tmp/.sh_history.$LOGNAME

This way, when the user logs in, the file /tmp/.sh_history. is created and this files contains all the commands that the user enters.

-Santosh

[James R. Ferguson]

Hi Jackie:

You might consider establishing a 'script' file at the end of the user's $HOME/.profile:

...
script userlog

See the man pages for 'script' for more details.

Regards!

...JRF...

[Eugen Cocalea]

Hi,

putting things in user's profile can be overwritten by the users. A solution would be to put it in /etc/profile.

E.

[Eugen Cocalea]

Hi again,

and putting it in the /etc/profile will result in the file to be created with the user as its owner thus writtable by user.

E.

[James R. Ferguson]

Hi (again) Jackie:

Obviously, the shell history file and my simple suggestion of capturing a session's dialog into a file leave the control of those files in the user's hands. The user can easily remove or null the files used to collect the data.

If you really want to collect and monitor accounting information you need to setup system accounting functionality.

Begin by looking at the man pages for 'last' (man 1 last) and 'acct' (man 1M acct). Have a look too, via:

http://docs.hp.com/

There is also an older white paper in the Technical Knowledge Base (#OALWP06950320) that provides a good overview of accounting in general.

Regards!

...JRF...

[Michael Tully]

Hi,

The suggestion of setting up user
accounting is of course the best
method if you want to capture user's
commands etc. This is about the only
way you monitor without the risk of
the user examining and overwriting files.
Just be aware that if you start using
accounting on all users or even a fair
number your system will consume disk
space, so be aware of this before
you start.

HTH
-Michael

[Roger Baptiste]

Jackie,

In most of the cases, whether monitoring
or not, it makes sense to set the history
for the user profiles:
HISTFILE=$HOME/.sh_history
HISTSIZE=1024 <- (Size in bytes. Default is 128 bytes; you can increase or
decrease it , depending on the disk space,
number of users , necessity )
export HISTFILE HISTSIZE

The above commands is for Posix shell.
For C shell, you would need to use the
"set" syntax.

The history file is not protection
against users who want to cover their tracks,
since it can be edited. The question arises,
what's the motivation for the Monitoring?
In all the production boxes i handle, we
don't do that level of monitoring. If it
is a necessity for you, you would need
to enable the accounting option. (check man acct), but that consumes space and resources.


-raj