How to log user activities

[karstens]

Is there a possibility to log the activities of the users ?
I found the "script"-command. The problem is that the shell reacts on the exit command with an exit out of the "script"-command modus. I want to make logging fix but this is not possible if exit works like that. Has anyone a clue how to realize that ?

 

[KenCunningham]

Sorry, I don't quite understand. Script <filename> writes to the specified file and this will remain even after an exit. To append to an existing file use script -a <filename>

Hope I have understood your problem and that this helps.

 

[karstens]

The problem is that the user should not be able to work without being logged. If he types exit in this mode his further input / output will not been logged.

 

[slayne]

What level of logging do you need?
A simple list of every command entered?
Or do you need a complete session transcript, complete with all screen output?

 

[KenCunningham]

Is it not the case that if the user types exit they will be disconnected and therefore won't have any further input to record in that particular session? Or am I missing something here (probably...)? To activate the script, put it in the user's .profile so that it is automatically turned on when he/she logs in. I'd be careful with this though - the files could grow very large at a rapid rate. HTH.

 

[karstens]

A logging of commands would be necessary, a logging of all screen-output would be very nice !

 

[Einstein47]

This may be a different approach, but have you considered using the AIX audit command? It provides auditing of specific events or commands. Do a man audit to learn more about what it can do.

It may not be helpful at all, but you never know. Einstein47
(Love is like PI - natural, irrational, endless, and very important.)

 

[karstens]

The audit is not exactly what I mean, there must be a possibilty to log all activity ?!

 

[slayne]

You need to identify the type of users and what kinds of activities they will be doing. To capture the activities of users who just run an accounting program is much easier than capturing the activities of a programmer/developer/system admin.

Also, you need to identify how this information will be used. A simple session capture with every character sent to the screen may capture everything, but how functional is it to review?

 

[Einstein47]

There may also be legal issues regarding privacy that you need to consider. You don't want to be sued for invasion of privacy when you are trying to protect your systems. Einstein47
(Love is like PI - natural, irrational, endless, and very important.)

 

[nAtHaNs]

you may make use of the default history of commands and incorporate in a script. it is located at $HOME\.sh_history. as well as $HOME\smit.log and $HOME\smit.script.

hope this helps.