I wonder if there is something similar to an event listener in UNIX that a program can subscribe to? Specifically I want to know:
Start and end times of a user session Start and end of the applications executed by that user
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
The events that you're looking for can be found through psacct. Specifically I'd take a look at the tool
ac which shows accounting information on users. I touch on this in this U&L Q&A titled: Commands for determining level of usage of server.
NOTE: This is not a subscribe-able "service", rather a tracking & reporting infrastructure that you can ask it questions.
You can also use
lastcomm (part of psacct, it has several tools in the suite) to find out when a given application was used by user X.
$ lastcomm rm rm S root pts/0 0.00 secs Tue Nov 14 00:39 rm S root pts/0 0.00 secs Tue Nov 14 00:39 rm S root pts/0 0.00 secs Tue Nov 14 00:38
You'll have to dig a bit into
psacct but there's a lot of resources about it on U&L as well as google which should get you what you want.
The other tool, in the same vain as
psacct's tracking & reporting approach is
auditd you can query to find out who and for how long program X was run.
$ sudo ausearch -x /usr/bin/sudo | head -5 ---- time->Sat Dec 7 21:15:15 2013 type=USER_AUTH msg=audit(1386468915.558:419): pid=2189 uid=1000 auid=1000 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="saml" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success' ---- time->Sat Dec 7 21:15:15 2013
NOTE: The above is finding all the entries where someone ran the tool