Monitor commands executed from remote machine

[Murugan07]

Hi All,

I have a linux machine with RHEL4 and I need to monitor commands which are executed from other machines. How can I achieve this?

Is it ok to configure syslog for this?

Thank you,

[Alzhy]

It depends HOW the commands are executed remotely.

As you likely know -- there are MANY ways commands can be issued remotely and "monitoring" each will depend on the HOW.

And the methods are as follows as far as I can remember:

ssh
rexec
remsh
rsh
sockets (inetd/services model)
telnet
job control via - Maestro, Autosys, CTRL-M, etc.

Cheers.

[Murugan07]

Here in my case, I am sure other systems are using either ssh or remsh.
We had a bad script which deletes files from home directory instead of home/archive. The smae has been corrected now. Still I get cases like files getting deleted from home directory and I feel that script is run from some other machine as we had pushed this script to numerous machines.

[Thomas Callahan]

Check the /var/log/secure file. if it's a remote connection, it will show up as a login in that file.

[Murugan07]

Hi Thomas,
Thanks for your response.

I could see the login information from /var/log/secure file but could not see who deletes (through script, etc) the files which are under home directory.
Number of login/logout on this server is more than 10/min.

[Viktor Balogh]

The permission of the files/dirs might give you a clue who could delete it, i suppose not everyone has access to those files. filter those users from /var/log/secure and you'll get closer to the solution.

[Ivan Ferreira]

You can use Linux audit to identify who and how is deleting your files.

A quick howto here:

http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html