Log User Activity with Process Accounting
Keep a detailed audit trail of what’s being done on your systems.
Process accounting allows you to keep detailed logs of every command a user runs, including CPU time and memory used. From a security standpoint, this means the system administrator can gather information about what user ran which command and at what time. This is not only very useful in assessing a break-in or local root compromise, but can also be used to spot attempted malicious behavior by normal users of the system. (Remember that intrusions don’t always come from the outside.)
To enable process accounting, run these commands:
#mkdir /var/account#touch /var/account/pacct && chmod 660 /var/account/pacct#/sbin/accton/var/account/pacct
Alternatively, if you are running Red Hat or SuSE Linux and have the process accounting package installed, you can run a startup script to enable process accounting. On Red Hat, try this:
#chkconfig psacct on#/sbin/service psacct start
On SuSE, use these commands:
#chkconfig acct on#/sbin/service acct start
The process accounting package provides several programs to make use
of the data that is being logged.
The ac
program analyzes total connect time
for users on the system.
Running it without any arguments prints out the number of hours logged by the current user:
[andrew@colossus andrew]$ ac
total 106.23If you want to display connect time for all users who have logged
onto the system, use the -p switch:
# ac -p root 0.07 andrew ...