Keylogger / session monitoring in real time?
I'm looking for a keylogger/real-time SSH session monitor (if there is such util) for Slackware 10.1.
Kind of like a Terminal Server/VNC for SSH sessions. Where I don't have to 'cat log' or 'pico log', everytime.
Something like reading log files in real-time and seeing it update.
For What? :
This is for Administrative reasons. I want some people to ssh to my slackware 10.1 box, and I want to monitor them. Also, it's a part-time hobby of mine trying to be a Linux admin.
So far I tried Vlogger 2.1.1:
It's a great utility, but I don't know how to shut it off when I want it to. when I do ./vlogctrl unload, it says something like "rmmod: vlogger module is not loaded". When I go to the log file, I see it keeps on logging. I Wish I could turn it off when I want it to shut off. It also seems to crash my box causing a reboot and going through that disk check utility (when it does crash, vlogger won't run, so that's one way of shutting if off...heh). When I don't want it to shut it off, it works pretty well. Not sure if it produces output as if it were real time. (eg. vnc, terminal server)
I've been doing 'cat log' everytime to see the contents of the log file, which gets pretty cumbersome after a while,
I also tried using "TTYRPLD" but I couldn't get the patch to work (syntax was exactly the same in the instructions, but pertaining to my kernel) and it gave me some bogus error which I ignored, then later deleted the files, because I didn't know how to fix it.
Another program I looked into is LKL0.1.0, but it looks like it's used only for local purposes (correct me if im wrong).
Any other key/session logger I should try out?
Last edited by houler; 04-02-2005 at 11:18 AM.