LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 11-23-2004, 12:45 AM   #1
icyfire
Member
 
Registered: Feb 2002
Location: Bay Area, California
Distribution: Ubuntu
Posts: 110

Rep: Reputation: 15
How can I find out ANYTHING a user is doing?


Hi all,

I'm looking for a command to find out what anything a user is doing from an ssh terminal, basically beyond the scope of w or who. I'd like to know.. say, which folder a user is viewing, what command is being executed, what files are being accessed or copied, etc. If a user is using ssh, the only process listed with w is 'sshd'. When a friend is logged in, I'd like to know exactly what they're doing. Is there a log that keeps this information, a command that will list it, or is that limited by the ssh protocol?

Thanks,

~icy
 
Old 11-23-2004, 01:39 AM   #2
SciYro
Senior Member
 
Registered: Oct 2003
Location: hopefully not here
Distribution: Gentoo
Posts: 2,038

Rep: Reputation: 51
the grsec patch's for the kernel include extra loging features, one you might find useful is the exec logging, basically every command executed will be recoded in the log .... makes reading a pain so you will probably want to get a log viewer
 
Old 11-23-2004, 01:58 AM   #3
hutuworm
Member
 
Registered: Aug 2004
Posts: 130

Rep: Reputation: 15
You may want to try Snare for Linux
http://www.intersectalliance.com/projects/Snare/
 
Old 11-24-2004, 06:21 PM   #4
student04
Member
 
Registered: Jan 2004
Location: Georgia
Distribution: OS X, CentOS
Posts: 669

Rep: Reputation: 34
you could use top and filter out one username by pressing u
 
Old 11-24-2004, 11:02 PM   #5
Tap-Out
Member
 
Registered: Oct 2002
Location: Halifax, NS
Distribution: Ubuntu, Mepis, Debian
Posts: 130

Rep: Reputation: 15
If they're not using a GUI and they are using the command line same as you are, another thing you could do to see exactially what they were up to is.

Code:
cat /home/username/.bash_history
That will tell you every command they entered, be it a cd to get to a directory, a cat to look at a file or anything they excuted.

If they are running the GUI perhaps you could install something like VNC so that you can watch them, or even take control of them if need be.

Hope that helped a bit.

Cheers

Tap
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
cannot find user ID 500 fernin8r Linux - General 32 07-17-2007 02:32 PM
New user: can't find files Matty-J Debian 6 10-05-2005 11:13 AM
Can't find user id Navaboy Slackware 4 02-01-2005 11:26 AM
id: cannot find name for user ID 500 stakhous Linux - Newbie 1 07-02-2004 03:25 PM
Where to find the user log? kamil Linux - Networking 4 04-06-2002 05:10 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 01:28 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration