Server :: Monitor All Of The Activity Of The Users That Logging In?
May 2, 2010
I wanted to know is there any way to monitor (I mean log)all of the activity of the users that logging in a server (as root) for example:
1.when do they logging in
2.what commands do they use at what time ( I know that history command do somehow the same but it does not save all of the activity of users exactly with the time of that activity)
3.which one of them installed which package on the server
4.what did they copy or move at what time and summery all the activity that each of them do on the server individually.
I have been using Postfix since 2006 with no problems ever. Simple & rock solid however I was wondering what you guys use for monitoring all your email traffic and logs? Is there an application or utility you guys suggest using as a mail administrator to easily scan / view logs in a organized and clean view?
I have an issue with users logging into a server. There are multiple (5 or so) database admins that have to log into a windows 2003 server and from there log into a red hat server. Once they are in the rhel box they execute an app (let's say xclock) that gives them an xwindows session on their desktop. Currently only one person can do this at a time, but they have asked me to configure it to allow multiple users to log into the red hat box from the windows server and run an xwindow.
I'd like to essentially log the firefox status bar "waiting for x...", "transferring from x...", all those messages. Really what I'm after is a log of all servers contacted.
I don't know if this is possible... I want that only some of a Windows Domain(Samba) users can to logging in a machine.For example: The user Peter of the domain WORKSPACE can connect to the PC1, but the user Charly of the domain WORKSPACE can not connect to the PC1. How I can implement this?
How do you guys to do just that? I know the option for global logging, with parameters --log on service run or log-bin and err-log for inside my.cnf. But what i am looking for is a way to log specifically a table activity, any activity, be it select or update queries.
when the server is getting overloaded with users. At present I run the server mainly as a proxy server with about 100 users. The bandwidth at the data centre is 100Mbps connection with total bandwidth used last month = 17431.16 MB
I would like to add a VPN in future but feel that this might overload the bandwidth as instead of it just being web traffic it will the entire client TCP connections. I would like to monitor this before it gets to the stage where users are complaining but not sure how to gauge whether the proxy is being overloaded. It is used mainly for video traffic.
I have an auditing problem. I am required to be able to track user account modifications (creates, deletes, password changes, etc.) My team and I implemented auditd 1.7.17 and borrowed an existing rule set from /usr/share/doc/audit-1.7.17/nispom.rules. What we're seeing is that user account activity from the command line is retrievable by doing an 'aureport -m'. However, doing the same through the GUI, 'aureport -m' does not display the activity. So I have two questions:1. Is there another location I should be looking to find the user creation activities when using the GUI?2. Is there a way to make the activity using the GUI be captured in /var/log/audit/audit.log so 'aureport -m' can report it?Someone suggested a PAM configuration change, but was not able to tell me what change to make.
I need a software that monitors the total internet data-transfer since I use a limited data-transfer scheme. The USB modem that I have has a software but that works only with Windows. In spite of installing Wine, it doesn't monitor the data-transfer.
I need something to monitor and record the activity of the top 5 processes in terms of CPU usage and load average during a specific timespan. I'm having some spikes in the morning and just realized it's not always at the same time so it's hard to get up and watch the processes with top. I need something that records CPU usage and load average of the processes from 4AM to 9AM (for instance) so I can debug the process that it's consuming my CPU and spitting +80 e-mails with monit each day.
I need to have the ability as network administrator to see what everyone connected to our internet is doing, the sites their visiting and emails being sent.
I'm interested in altering the activity-monitor/pointer on my distro or at least finding out more about it. Is it part of Gnome or KDE or is it else where?
Fedora 13 is currently my Linux Distro of choice but I find the Pointer/Activity-monitor is annoying. Usually it has two states ,the solitary round thing or the pointer. Every now and again they are combined into the Ubuntu combination symbol of the two joined into one image. Is there a way to change this image/moving-icon? I like Mandriva's the best and would prefer it worked on all Browser windows so that New Firefox versions did not disable it.Thanks in advance!
The term I needed to find additional info was (Mouse Themes). The (Wait Cursor) is usually included with this.Download the theme you want and go to System> Preferences> Appearance> Customize> Pointers to change to one that is alreadly installed.To install themes, System> Preferences> Appearances> Install. Apparently more than one them can be used on a distro so the Browsers will use its own while Nautilus will use another. Fedora's default one does not funtion properly. It will not change to the pointer if a web page is still loading if you need to sellect something. I learned that Mandriva uses the (Bluecurve) variation for default which is like Ubuntus where it does not have to change between two different images and hense does not lose functionallity.
I tried to do a scheduled software update several times today (8/20/11) and nothing seems to download, though I do get the "Downloading" PackageKit dialog message (the System Monitor shows practically no network activity). In between tries I downloaded some 600 MB .iso files (about 10 minutes each) so I know my internet is working properly. That leaves either PackageKit got hosed in my last update, or servers are down.
Feb 10 (today) user qt4 extracts from cd /var/log/secure grep -i 'feb 10' secure Something wrong with pam or selinux? I have not fooled with pam or selinux in decades The secure file seems to report problems I do regular yum update s from secure: above
secure:Feb 10 08:00:20 localhost pam: gdm-password[2396]: pam_unix(gdm-passwordession): session opened for user qt4 by (uid=0) secure:Feb 10 08:00:48 localhost polkitd(authority=local): Unregistered Authentication Agent for unix-session:/org/freedesktop/ConsoleKit/Session1 (system bus name :1.37, object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)
[code]....
I can login to qt4 from another user via "su - qt4" I would be shot if I inserted the inserted secure file
Sitting at the console, I log in with any user name and NO PASSWORD IS REQUESTED. I get logged in automatically without entering the user's password.
I did: passwd joeuser
To change his password and still he goes right in without being asked for a password!
Possibly related- 10 days ago, my smtp server was breached as a spam relay. The username they cracked was deleted. I added fail2ban for postfix. The logs show no further intrusion.
I am looking for a simple process monitor to monitor CPU, ram, swap usage of selected processes and log the information to a csv file at a specified interval.
Or is there a way pipe the information I want from top to a csv file?
I have an external USB drive that is NTFS. It mounts fine under my account and my wife's, but only if I fully shut-down the computer between switching. While switching users or logging out then in with a different account it will not mount the drive. I am not sure what to do... but we both access data from the same drive.
I'm installing a server to act as a firewall between a local network and internet. I've installed Firestarter becaused it worked straitgh away (it seems that FS is configuring the routing as well). I've tried to remove it, and then I lost the access from LAN to Internet. (I don't know why -perhaps the routing is disabled then- , so I prefer to keep it).
The problem is that Webmin Bandwidth Monitor (bandwidthd) is not logging anything when FS is active. Does someone has an idea on how I could make it work? I've tried cacti and some other stuff, but it is far too complicated for me.
I tried to create a user on Solaris 10 but when I try to login the user with "su -" I get the error message "no directory". When I try to login with "su" I get the error message "no shell".
I tried the useradd several combinations e.g.
All the tries i made didn't work. I also checked the permissions on /etc, /bin, /sbin and / and it seems ok so that the newly created user can access them.
I need to trace/track email activity in my ubuntu server, normal i use this command tail -f /var/log/mail/mail.log, more or less. But the problem i am facing is that it take a long time to go through the entire log as my server recieves thousands of emails per day. is the a code that i can use to search email in the log, for instance need to find perfectpol@mycompany.com in the mail log.
Secondly; if there is an email that is blocking others on the queue how can it be remove or forced to go the mailbox. or to view its contents in order to decide whether to remove it or not.
Had a problem that are said not arrival or that are delivered as late as a day and sometime 6hours.
we need to log web access of a certain set of users for analysis. We decided to setup a proxy server which just logs all the requests but does not do anything else like caching/access control etc.All users will be using a fixed set of computers and hence we can redirect their requests to the proxy. I came across Squid, but found it to be too heavy for our requirements. Is there any other proxy-server software that is good enough for what we want or is Squid the only way?
I need to setup a box to monitor what websites users are accessing on a small network.I don't have a switch with a spam port, but I do have a machine with two nic cards. I would like to set it up between the router and cable modem so that users won't know it is there but it logs all the websites that are being accessed.
I am going to build a Linux VPN server(PPTP) for my friend but here is the problem: He don't know Linux and command line to manage users, monitor server, etc
I have inherited a RedHat 5.4 server that is having an odd issue. Root and all of the user accounts can log in via SSH. Not a single account can log in via the console (sitting in front of the server). If I bring it up in single user made, I can log in with root all day long.
I want to say that this has something to do with PAM, but this is when I play my "Noob" card. Could anyone possibly steer me in the right direction to figure out what is going on?
i am learning about the ability to utilize the rsyslog ability to be a server for the logging info from other machines. i have did it successfully, and i get logs from other machines through the network, but i don't know where i can set the server for my desire act on these logs that come from the network. i essence the question is: why the server put some logs at /var/log/messages, and others not ?
I have 2 servers running CentOS 5.4 Final, one is 32 bit and the other is x86_64.When I ssh to either server, the session will freeze after a while and I cannot type anything except I close the term. This has happened before, and I thougthat was caused by iptables' rulesBut now I turned off iptables and the problem remains.I tried tcpdump on my machine(client running OpenSUSE 11.2), and it shows that after the freezing, client will still sent ack message to the server.So I think this may be caused by the server.Note that I can ping the server smoothly.Does anybody meet this problem before
