How to Keep track user activity in Linux

[Md. Minhaz Khan]

Dear concern,

Is there any way to keep track user activity in the command line? I have implemented this by adding following lines in the ".bash_profile" file:

touch ~/Session/command_in_session_`date "+%y%m%d(%H:%M)"`
cat ~/.bash_history >> ~/Session/command_in_session_`date "+%y%m%d(%H:%M)"`
echo " " > ~/.bash_history

But is there any way to implement user level Auditing in Linux from which we can tracking user activity??

Thanks
Minhaz

[Steven E. Protter]

Shalom,

Standard.

Set variables HISTORY and HISTSIZE

That creates keyboard logs.

http://secureaudit.sourceforge.net/

http://www.sans.org/score/checklists/AuditingLinux.doc

http://www.linux.com/archive/feature/114422

SEP

[Court Campbell · Accepted solution]

I like ossec.

http://www.ossec.net/

When setting things like this up you want to define what you are looking for. Logging all user activity is kind of pointless. Do you really want to know that they changed a directory? Probably not. Good luck!

[Ivan Ferreira]

You could use "screen" to catch all user session. You can use auditd to audit the commands executed or file access.

[Victor Semaska_3]

There's also sudosh.

http://sourceforge.net/projects/sudosh/

[Md. Minhaz Khan]

Dear court

I have already install HIDS server and Agent in my linux box. Can uou help me in detail what you have implemented in your production

Thanks
Minhaz

[dirk dierickx]

check out Laus, it's included by default with RH, a guide can be found on the RH knowledge base;

http://kbase.redhat.com/faq/docs/DOC-6613