Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was just wondering what the best tools for retracing logs and what logs I should be checking to work out what's going wrong with a server, or what the client has executed to get the server into it's current state.

I know you can use the .bash_history file, but it seems to only list bash commands, I think. As far as I'm aware. I was just wondering if there's any handy tools that I could be using to aid me in log mining and such like?

Also, I need to monitor FTP usage and such like as well, so I know what they've deleted by accident and such like. Just anything to do with general server maintenance.

I'm using CentOS 6.3


share|improve this question
up vote 2 down vote accepted

One of the tools you can use to record what users have run is psacct. After installing it in CentOS, you can enable the psacct service and use the commands sa and aureport to get an idea of what's been run by who.

Additionally, if you were trying to log every keystroke the user was typing in, you could use the pam_tty_audit module, as mentioned by Janne Pikkarainen in this question here. It's built into PAM on CentOS 6.3, so all you have to do is enable it by adding it to the config you want under /etc/pam.d (login, for example). Afterwards, aureport --tty will show every keystroke (including shell session passwords, so beware).

As for monitoring FTP usage, you should only need to set the appropriate logging options for whatever FTP server software you are using.

share|improve this answer

Your question is quite broad and I am not in the position to satisfy you 100% but here are a few tools that would be the basis of good system monitoring.

sysstat provides the sar command and often creates cron jobs to populate several logs with IO, Memory, CPU usage, etc. information. These information can be consulted with sar. This can be extremely useful to see when and how something got wrong, though it won't point to any process as this is not recorded.

sudo is handy in tracking system changes. 'root' should be deactivated to best work, as then every system command should go via sudo and would be track in syslog.

Update syslog.conf to suite better your needs in terms of verbosity of the logs.

share|improve this answer

For starters you can use logwatch. It is part of CentOS and will monitor all relevant system logs of installed software that is part of CentOS and uses the original log-names and locations.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.