[plug] Monitor User Activity/Processes

[Bernard Blackham]

On Wed, Oct 06, 2004 at 06:15:33PM +0800, Craig Ringer wrote:
> Tim White wrote:
> >The answer is probably obvious but I thought I would ask any way.
> >I want to be able to monitor user activity, e.g. log an event when a 
> >user opens(start)/closes(end) a file/process.
> 
> I don't know if it's capable of exactly what you want, but it sounds 
> like you should investigate BSD process accounting. Yes, it works on 
> linux too, and support is compiled into most standard kernels.

grsecurity will do a similar thing but log every process executed
with arguments to dmesg, where you can (you /want/ to) filter it out
to files. You can also configure it to only do it for users in a
certain group.

Bernard.

-- 
 Bernard Blackham <bernard at blackham dot com dot au>