LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   Keylogger / session monitoring in real time? (https://www.linuxquestions.org/questions/linux-security-4/keylogger-session-monitoring-in-real-time-308958/)

houler 04-02-2005 10:53 AM

Keylogger / session monitoring in real time?
 
I'm looking for a keylogger/real-time SSH session monitor (if there is such util) for Slackware 10.1.

Kind of like a Terminal Server/VNC for SSH sessions. Where I don't have to 'cat log' or 'pico log', everytime.

or

Something like reading log files in real-time and seeing it update.

For What? :

This is for Administrative reasons. I want some people to ssh to my slackware 10.1 box, and I want to monitor them. Also, it's a part-time hobby of mine trying to be a Linux admin.


So far I tried Vlogger 2.1.1:

It's a great utility, but I don't know how to shut it off when I want it to. when I do ./vlogctrl unload, it says something like "rmmod: vlogger module is not loaded". When I go to the log file, I see it keeps on logging. I Wish I could turn it off when I want it to shut off. It also seems to crash my box causing a reboot and going through that disk check utility (when it does crash, vlogger won't run, so that's one way of shutting if off...heh). When I don't want it to shut it off, it works pretty well. Not sure if it produces output as if it were real time. (eg. vnc, terminal server)

---edit---
I've been doing 'cat log' everytime to see the contents of the log file, which gets pretty cumbersome after a while,

---edit---

I also tried using "TTYRPLD" but I couldn't get the patch to work (syntax was exactly the same in the instructions, but pertaining to my kernel) and it gave me some bogus error which I ignored, then later deleted the files, because I didn't know how to fix it.

Another program I looked into is LKL0.1.0, but it looks like it's used only for local purposes (correct me if im wrong).


Any other key/session logger I should try out?

TylerD75 04-03-2005 04:10 AM

Not really a proggie, and you probably know about it, but I use tail -f /var/log/<logfile> to get a realtime view of the log...

neo77777 04-06-2005 09:21 PM

You can also use roottail, it is a simple utility that will tail the log files and output them to your desktop, you can costumize it for diffrent log files and diffrent color scheme to alert you (visually) of what is going on log-wise.


All times are GMT -5. The time now is 12:58 AM.