I wonder if there is something similar to an event listener in UNIX that a program can subscribe to? Specifically I want to know:

Start and end times of a user session
Start and end of the applications executed by that user

Any Tips?

1 Answer 1


Using psacct

The events that you're looking for can be found through psacct. Specifically I'd take a look at the tool ac which shows accounting information on users. I touch on this in this U&L Q&A titled: Commands for determining level of usage of server.

NOTE: This is not a subscribe-able "service", rather a tracking & reporting infrastructure that you can ask it questions.

You can also use lastcomm (part of psacct, it has several tools in the suite) to find out when a given application was used by user X.


$ lastcomm rm
rm                S     root     pts/0      0.00 secs Tue Nov 14 00:39
rm                S     root     pts/0      0.00 secs Tue Nov 14 00:39
rm                S     root     pts/0      0.00 secs Tue Nov 14 00:38 

You'll have to dig a bit into psacct but there's a lot of resources about it on U&L as well as google which should get you what you want.

Using auditd

The other tool, in the same vain as psacct's tracking & reporting approach is auditd. With auditd you can query to find out who and for how long program X was run.


$ sudo ausearch -x /usr/bin/sudo | head -5
time->Sat Dec  7 21:15:15 2013
type=USER_AUTH msg=audit(1386468915.558:419): pid=2189 uid=1000 auid=1000 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="saml" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
time->Sat Dec  7 21:15:15 2013

NOTE: The above is finding all the entries where someone ran the tool /usr/bin/sudo.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.