20

I'm running Ubuntu 10.04. Is there a way I can get a daily report of who has logged onto the box, what time, and even - this may be asking too much - a report of the commands they used? This is a low-usage box and so I think this would be a nice way to see what activity is happening on it.

Along these same lines, I heard it was not possible to track when things are done on the box via non-interactive shells, such as rsync or just remotely executing single commands via ssh. Is that true, or is there a way to log and track this as well?

19

The information of who logged in when is available in /var/log/auth.log (or other log files on other distributions). There are multiple log monitoring programs that can extract the information you configure as relevant. On any sane system, every user authentication is logged.

To log every command invocation (but not their arguments), use process accounting, provided by the acct package Install acct on Ubuntu. If the accounting subsystem is up and running, then lastcomm shows information about finished processes.

  • 2
    /var/log/secure.log is another common logfile – Adrian Cornish Dec 13 '11 at 4:38
8

You can also use who or w to see who is currently logged in to the system, including SSH users.

  • 10
    last might be a better option for what the OP was looking for... – jasonwryan Dec 13 '11 at 6:11
  • 1
    indeed. "last" is the command you want. – Sirex Dec 13 '11 at 9:14
  • 1
    This is a MUCH better answer then the selected one. – PaulBGD Jun 18 '14 at 23:17
0

Usually when some one logs into a user system then in /var/log/messages it gets printed as:

sshd[18468]: Accepted keyboard-interactive/pam for root from 134.64.66.666 port 49867 ssh2

So just grep the messages as:

grep -E "Accepted keyboard-interactive/pam for" /var/log/messages
0

You can also modify the bash shell to do some rsylog.

Effectively, you setup rsyslog on a remote host to accept specific connections. Then modify the host shell on which you want to monitor - by compiling your version, with one which has the following enabled:

vi config-top.h
#define SYSLOG_HISTORY
#if defined (SYSLOG_HISTORY)
#  define SYSLOG_FACILITY LOG_USER
#  define SYSLOG_LEVEL LOG_INFO
#endif

Once compiled with this enabled, you can replace bash with this version OR have users be logged into this one by redirecting their logins to it.

For more info:

https://www.pacificsimplicity.ca/blog/remote-logging-using-syslog-and-logging-shell-commands-remotely

  • Fine. I will update it. – mcdoomington Jul 7 '16 at 17:53

protected by Community Dec 12 '17 at 11:29

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.