63 comment

1. It’s “sa”, not “su”…

2. I think there’s an error at
   Display output per-user:

   Display the number of processes and number of CPU minutes on a per-user basis

   shouldn’t be sa -u and sa -m ?

3. @Andreas and GeorgeB,

   Typo is fixed.

   Thanks for heads up!

4. So why is Solaris a “Unix like” OS. Last time I looked it was based on System V.

5. So why is Solaris a “Unix like” OS

   It is certified as a version of Unix. Late 1990s Sun replaced the BSD-derived SunOS 4 with a version of UNIX System V Release 4 (SVR4),

   When I say UNIX like means other all oses such as OpenBSD, AIX, Linux, FreeBSD etc.

6. Hi,

   Any command to flush old data like daily basis ?

   1. Keep the data in /tmp and setup a cron job to delete it at midnight.

7. Lokesh,

   Sorry but I don’t get your question…

8. On Debian/Ubuntu systems it is in the ‘acct’ package and can be installed with ‘apt-get install acct’.

9. Hi,

   Iam planning to take daily audit output , once after taking data of audit report i need to remove old data and take next day report only with out old data.

   Plze let me know , if u need more info.

   Thanx
   Lok

10. Is there a way to prevent this information from being modified? I assume that somebody who roots a machine would clear/alter the accounting records. Is there a way to have this send, say, over a serial link to another machine in realtime?

11. Hi

    This is reagrding lastcomm in Linux.
    userhelper S X vivek pts/0 0.00 secs Mon Nov 13 23:58
    userhelper S vivek pts/0 0.00 secs Mon Nov 13 23:45
    rpmq vivek pts/0 0.01 secs Mon Nov 13 23:45

    what is this 0.00 or 0.00 or 0.01 secs its CPU time or actual time.
    What is Nov 12 23:45 etc

    Regards
    JP

12. Hello,

    0.00 secs Mon Nov 13 23:58 ===> time the process exited

    HTH

13. The lastcomm command will not display the path from which command was executed as well as the argument passed to the command

14. Unfortunately it looks like it doesn’t record the command unless it completes. So if you dump the box, you won’t be able to find the command that might have cause it to crash.

15. Hi…

    I am installing psacct on my CentOS box. lastcomm and sa commands give no output. Infact in /var/account there is only a single file created pacct which too is 0 bytes. Am i missing some other configuration.

    Note: kernel version is 2.6.15.1
    / and /usr/local are read only partitions.
    /var has read-write permissions.

    Warm Regards
    KM.

16. Don’t forget to run following two commands:
    chkconfig psacct on
/etc/init.d/psacct start

    After that wait for some time and run a few commands. Try again. Lemee know

17. Any idea how to get a non-truncated command to print out? Example:
    
    /home/charlie/my_favorite/command/in/the/world
    
    …will display as something like…
    
    /home/charlie/my_fav
    
    Does the acct process store the command as typed so that there I might be able to find a way to access it in the pacct file? Also, is there any way to open this pacct data file in some sort of editor to see what all is stored in it?
    
    Thanks!
    
    Unca Xitron

18. I am using SLES 9. I would like to get a log when my users have changed their password. How do I do it.

    In fact I found this available with SLES 10 in the /var/log/messages file. But not finding the same in SLES 9. Please help.

    Regards,

    Soumen.

19. To clear the file which saves the pacct information run this command.

    rm -f /var/account/pacct

    We have to re-initialize the pacct command as explained in the tutorial after executing this command.

    Cheers
    Koushik

20. Can I trace back the variables in the command, say, instead of only knowing someone ran ping, but also know which ip address she ran ping against?

21. This only seems to track the command and not the arguments used to run the command:

    Eg. rm -rf / would only show rm which is not much of any use.

    Am I missing something?
    Danny

22. Is there any way that we can log the arguments as well using this ? Can anyone suggest an alternative way of tracking users and the commands they have run?

    Regards
    Sajindra

23. Thanks for the usefull howto,
    as stated above, i’m also missing the ability to log the variables given to a command, this would be very usefull in my opinion.
    greets

24. @danny, @brein and others;

    There is a package called “snoopy” it wraps “exec” calls and logs any command that has been run, it logs user, command and parameters. It does not log shell builtins like cd and ls, as they do not call exec.

25. I have a similar configuration to KM(15) above and have the same issues and problems he reported. Is there something I am missing? Below are some things I did on this machine and the results

    [root@sandbox ~]# ac dheth
    total 306.91
    [root@sandbox ~]# /etc/init.d/psacct status
    Process accounting is enabled.
    [root@sandbox ~]# passwd dheth
    Changing password for user dheth.
    New UNIX password:
    BAD PASSWORD: it is based on a dictionary word
    Retype new UNIX password:
    passwd: all authentication tokens updated successfully.
    [root@sandbox ~]# lastcomm passwd
    [root@sandbox ~]# lastcomm –help
    Usage: lastcomm [-hV] [-f file] [command] … [user] … [terminal] …
    [–file ] [–strict-match] [–print-controls]
    [–user ] [–tty ] [–command ] [–debug]
    [–version] [–help]

    The system’s default process accounting file is /var/account/pacct.
    [root@sandbox ~]# lastcomm –debug|more
    [root@sandbox ~]# lastcomm –version
    lastcomm: GNU Accounting Utilities (release 6.3.2)
    [root@sandbox ~]# ac –version
    ac: GNU Accounting Utilities (release 6.3.2)
    [root@sandbox ~]# uname -a
    Linux sandbox.****.com 2.6.9-023stab046.2-enterprise #1 SMP Mon Dec 10 15:22:33 MSK 2007 i686 i686 i386 GNU/Linux

26. I ran
    accton /var/log/pacct

    on all the machines I have. But while on one machine “sa -m” is showing correct output,
    other machines are giving error as follows :
    sa -m
    sa: ERROR — print_stats_nicely called with num_calls == 0
    Why is this happening ? Anything wrong?
    pbt

27. Hi there. I now that this is a really old post, but I need to ask something.

    For how long the lastcomm will store commands? Lets say I’ll install a linux box today and start the psacct service. In 4 months, commands from the first days of the machile will be there? Or it only keeps something like the last 30 commands?

    Regards,

    Pedro

28. The accounting process is easy to use but SUDO audit file can give you a better audit trail. Sudo lists everything you need to know about what has been done on the machine, including the user who became the super user and the arguments were passed to the command, timestamp, etc the downside of SUDO log file is that it is not easy to work with, at least in my experience.

    Nice tutorial

    Regards,

    Abdellah

29. I started the “psacct” service, but still “accton” is not showing any output while other commands are working like sa, lastcomm & ac.
    Where am i doing wrong?

30. Hi,

    Im interested to know is there a way to log all keystrokes including typos & complete command parameters with this say $rm -rf /* or custom scripts such as $./foo 10.0.0.1
    My requirement is to log *EVERYTHING* the command and its associated flags and parameters.

    Thanks

31. A more suitable way on modern distros (Centos 5 + ) is to install the pam_tty_audit pam module and place it into a pam stack for say, login or sshd.

    This will produce a key by key typing of what was pressed inside the session. (including, up, down backspace, etc)

    You can use ausearch to look through it.

    I.E “ausearch -ts recent -m tty -i”

32. Hi,
    pam_tty_audit is kool, but problem is that it logs only root level stuff. Is there anyway to make it log user level tty input without patching it?

    Thanks

33. Yeah, pass it something like:
    
session required pam_tty_audit.so enable=*


    To the pam stack.

34. Thanks Deleriux, I tried that but no luck :S. It seems im getting it wrong somewhere:

    [fimz@localhost ~]$ sudo vim /etc/pam.d/sshd
    [fimz@localhost ~]$ cat /etc/pam.d/sshd
    #%PAM-1.0
    auth include system-auth
    account required pam_nologin.so
    account include system-auth
    password include system-auth
    session optional pam_keyinit.so force revoke
    session include system-auth
    session required pam_loginuid.so
    session required pam_tty_audit.so disable=* enable=*
    [fimz@localhost ~]$ date
    Wed Sep 23 11:29:16 NZST 2009
    [fimz@localhost ~]$ sudo su –
    [root@localhost ~]# service sshd restart
    Stopping sshd: [ OK ]
    Starting sshd: [ OK ]
    login as: fimz
    fimz@X.Y.2.3’s password:
    Last login: Wed Sep 23 11:24:02 2009 from it029481.xyz.org
    [fimz@localhost ~]$
    [fimz@localhost ~]$ ls
    Desktop
    [fimz@localhost ~]$ ls -a
    . .bashrc .gconfd .gtkrc-1.2-gnome2 .redhat
    .. Desktop .gnome .ICEauthority .Trash
    .bash_history .dmrc .gnome2 .metacity .viminfo
    .bash_logout .eggcups .gnome2_private .mozilla
    .bash_profile .gconf .gstreamer-0.10 .nautilus
    [fimz@localhost ~]$ ls -l
    total 8
    drwxr-xr-x 2 fimz fimz 4096 Sep 10 16:02 Desktop
    [fimz@localhost ~]$ mount
    /dev/mapper/VolGroup00-LogVol00 on / type ext3 (rw)
    proc on /proc type proc (rw)
    sysfs on /sys type sysfs (rw)
    devpts on /dev/pts type devpts (rw,gid=5,mode=620)
    /dev/sda1 on /boot type ext3 (rw)
    tmpfs on /dev/shm type tmpfs (rw)
    none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
    sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
    [fimz@localhost ~]$ date
    Wed Sep 23 11:31:05 NZST 2009

    [fimz@localhost ~]$ sudo grep mount /var/log/*
    /var/log/secure:Sep 23 11:31:56 localhost sudo: fimz : TTY=pts/1 ; PWD=/home/fimz ; USER=root ; COMMAND=/bin/grep mount /var/log/acpid /var/log/anaconda.log /var/log/anaconda.syslog /var/log/anaconda.xlog /var/log/audit /var/log/boot.log /var/log/boot.log.1 /var/log/boot.log.2 /var/log/btmp /var/log/conman /var/log/conman.old /var/log/cron /var/log/cron.1 /var/log/cron.2 /var/log/cups /var/log/dmesg /var/log/faillog /var/log/gdm /var/log/httpd /var/log/lastlog /var/log/mail /var/log/maillog /var/log/maillog.1 /var/log/maillog.2 /var/log/messages /var/log/messages.1 /var/log/messages.2 /var/log/news /var/log/pm /var/log/ppp /var/log/prelink /var/log/rpmpkgs /var/log/rpmpkgs.1 /var/log/rpmpkgs.2 /var/log/samba /var/log/scrollkeeper.log /var/log/secure /var/log/secure.1 /var/log/secure.2 /var/log/setroubleshoot /var/log/spooler /var/log/spooler.1 /var/log/spooler.2 /var/log/squid /var/log/tallylog /var/log/vbox /var/log/wtmp /var/log/Xorg.0.log /var/log/Xorg.0.log.old /var/log/yum.log

    I was expecting it to log to messages, but apparently its not!

35. You should probably remove disable=* as it makes the thing a little ambiguous.

    1. I’m running with pam_tty_audit and it appears it only logs root level key events, regardless of the settings in the session entry. It seems to ignore the disable= and enable= settings. The man page has the example of enabling root, but specifying a different user (ex enable=username ) still logs root only.

36. Oh, and to check audit you need to run something such as
    
ausearch -ts recent -m tty


37. Try snoopy logger. I’ve just updated it and it works ok for me now.
    https://sourceforge.net/projects/snoopylogger/

38. Snoopy compiles and loads, but so far it seems to work only to log root commands, and I modified snoopy.h
    #define SNOOPY_ROOT_ONLY 0
    with both 0 or 1, makes no difference, keeps logging only root commands.

39. @jav:

    Weird. Can you compile and run this program once as root and once as non-privileged user on your system? Source here:
    http://source.a2o.si/tmp/snoopy/test-getuid.c

    Compiled for Linux 32bit here:
    http://source.a2o.si/tmp/snoopy/test-getuid

    Post the results on sourceforge issue tracker please (in order not to bloat this blog post with irrelevant comments)
    Tnx!

40. I’m not totally sure yet, but support for process accounting has to be also enabled in the kernel to make all features of acct work.
    => CONFIG_BSD_PROCESS_ACCT

41. hi, i just installed snoopy on fedora 12. but i dont know how to view log. where snoopy`s log file located? could u explain me pls/ i read instruction file but nothing found something that help me. sry my bad english

42. Hi,

    I gone through the entire comments but nobody clearly spacifying..is there any tool for tracking the user executed commands and path of the file/folder.

    Like [root@nisslave pravi]# pwd
    /home/pravi
    [root@nisslave pravi]# cat test
    dfasdf
    [root@nisslave pravi]#

43. @praveen c: “pwd” is a shell built-in command and is not executed. However snoopy does exactly what you have described.

44. I’ve taken a project to work upon tracing of runtime activities on unix system
    into a log file. Like, to implement a program which will show the log of everything
    happened in past, including many requirements, like applications i used (with the time of access),
    kind of files/directories i opened, closed, created, deleted(with the time), etc.
    .
    Please suggest me something to do it in a better way.

    1. rm vivek pts/0 0.00 secs Tue Nov 14 00:30
       rm vivek pts/1 0.00 secs Tue Nov 14 00:30
       rm vivek pts/1 0.00 secs Tue Nov 14 00:29
       rm vivek pts/1 0.00 secs Tue Nov 14 00:29

       vivek is remove many files. The command just showing “rm” command, So how could i know what did he remove ??????

       Please help

    2. ankit, let me know if you have done with your project. I am also doing the same project and I really need help in that.

45. Just knowing the command (by itself) the user ran is useless. You absolutely need it’s arguments, and the parent process’s CWD. Other than that, it’s a “cute” toy, and little else.

46. Thanks for the useful how to,

47. I need to implement a program in shell programming which will show me the log of everything happened in past. It should show me who has logged in and list its activities. It can include many requirements. Kind of applications he/she used (with the time of access), kind of files/directories he has opened, closed, created, deleted (with the time) and many more information. please help me for the same.
    MJ

48. I wrote a method to log all ‘bash’ commands/builtins into a text-file or a ‘syslog’ server without using a patch or a special executable tool.

    It is very easy to deploy, as it is a simple shellscript that need to be called once at the initialization of the ‘bash’.

    see the method here

    cheers
    Francois Scheurer

49. how to install accounting package on cygwin?please help?

50. Hello,
    i want to know which ip logged into my centos server and deleted my data. Is there a command or some script you can provide me ? I’ve lost my client’s all data but unable to track ip log, which used command “rm -Rf ” to remove client’s data. Help will be highly appreciated. THanks

51. Hi This is good, but it is not enough as context change and knowing that a file was deleted doesn’t explain why it was.
    How can I record both the command line and the screen result ?
    Cherry on the cake would be to export in real time the output to syslog so that user can’t modify it.
    That would be superbe !

52. I have a question about how far back the ‘ac -p’ command goes. Is it for the current month? I have been using the a cronjob to process the wtmp file each month for accounting purposes but I’m looking for some alternate ways to do this. I would really like to be able to organize my individual user logins by the groups they are in but it does not seem like this information is tracked by wtmp.

    Thanks for any assistance you can offer.

53. is there any way to analyse log without going to all log files , it is very tedious , will aurport or ausearch work or they work only with log generated by auditd ?

54. Hi,

    My question is also simple. Is it possible to capture the arguments after rm command or kill command through lastcomm?

    like I am doing rm -rf myfolder
    rm -f myfile
    kill -9 123456789

    so I want the lastcomm should capture both the rm/kill commands & the argument.

    Thanks in advance

55. thanks, i am using this tools these days , but i found that the information accounted by psacct will reset several days once. do you know how to change it because i want to monitor my computer for a long time. thanks again.

56. Is there such a way to find the location where the Command is issued using ‘lastcomm’.. ?? plz help..

57. installed and run the programm. the total log time seems to be working fine, but when I specifically search for commands from user (lastcomm ‘user’) it doesnt display anything.

    What exactly should be showing here? I believe it should at least display apt-get commands (thats how i wanted to try it). furthermore will the commands per user also be logged when it has been denied? i.e. i log in as normal user and want to apt-get upgrade.

58. Hi,
    May I know how to find the fraction of the total audit storage capacity available in any Linux flavor?Preferably Redhat and Ubuntu.

    If any one has an idea on this, please let me know which command I can use.

    Thanks,
    Shreeman

59. I would suggest using “auditd” highy configurable to track almost everything possible.

Comments are closed.