4

I'm trying to find a way of logging what programs other users have been using on the system. I've checked /var/log but don't seem to find anything to show which programs have been accessed. I'm looking at historical use, so a ps, top or free isn't viable.

Thanks!

1 Answer 1

2

The Linux kernel has auditing capabilities.

You can install the packages auditd and system-config-audit to take advantage of this.

sudo apt-get install auditd system-config-audit

then to avoid an error you would get later, make a symlink of /usr/sbin/service to /sbin/:

sudo ln -s /usr/sbin/service /sbin/

Then launch the configuration interface:

gksu system-config-audit

enter image description here

Go to Configuration page

enter image description here

then click on the button Edit near File watches

enter image description here

click on the Add button

enter image description here

then enter the details of the executable you want to monitor, together with an optional distinctive string (just LS here), as in the following screenshot

enter image description here

Press OK, OK, Save and Save.

Now you can see the log of the monitored events with

sudo less /var/log/audit/audit.log

and you should get an output similar to the following:

type=DAEMON_START msg=audit(1325523963.095:8698): auditd start, ver=1.7.13 format=raw kernel=3.0.0-14-generic auid=4294967295 pid=31838 subj=unconfined  res=success
type=CONFIG_CHANGE msg=audit(1325523963.196:35): audit_enabled=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325523963.196:36): audit_backlog_limit=320 old=320 auid=4294967295 ses=4294967295 res=1
type=DAEMON_END msg=audit(1325524792.575:8699): auditd normal halt, sending auid=0 pid=32105 subj= res=success
type=DAEMON_START msg=audit(1325524792.613:8877): auditd start, ver=1.7.13 format=raw kernel=3.0.0-14-generic auid=4294967295 pid=32115 subj=unconfined  res=success
type=CONFIG_CHANGE msg=audit(1325524792.712:39): audit_enabled=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524792.712:40): audit_enabled=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524792.712:41): audit_failure=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524792.716:42): audit_backlog_limit=320 old=320 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524792.716:43): audit_rate_limit=0 old=0 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524792.716:44): auid=4294967295 ses=4294967295 op="add rule" key="ls" list=4 res=1
type=DAEMON_END msg=audit(1325524929.107:8878): auditd normal halt, sending auid=0 pid=32168 subj= res=success
type=DAEMON_START msg=audit(1325524929.139:3658): auditd start, ver=1.7.13 format=raw kernel=3.0.0-14-generic auid=4294967295 pid=32178 subj=unconfined  res=success
type=CONFIG_CHANGE msg=audit(1325524929.241:48): audit_enabled=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524929.241:49): audit_enabled=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524929.241:50): audit_failure=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524929.241:51): audit_backlog_limit=320 old=320 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524929.241:52): audit_rate_limit=0 old=0 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325524929.241:53): auid=4294967295 ses=4294967295 op="add rule" key="ls" list=4 res=1
type=DAEMON_END msg=audit(1325525132.140:3659): auditd normal halt, sending auid=0 pid=32407 subj= res=success
type=DAEMON_START msg=audit(1325525132.173:6001): auditd start, ver=1.7.13 format=raw kernel=3.0.0-14-generic auid=4294967295 pid=32417 subj=unconfined  res=success
type=CONFIG_CHANGE msg=audit(1325525132.274:57): audit_enabled=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325525132.274:58): audit_enabled=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325525132.274:59): audit_failure=1 old=1 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325525132.274:60): audit_backlog_limit=320 old=320 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325525132.278:61): audit_rate_limit=0 old=0 auid=4294967295 ses=4294967295 res=1
type=CONFIG_CHANGE msg=audit(1325525132.278:62): auid=4294967295 ses=4294967295 op="add rule" key="ls" list=4 res=1
type=SYSCALL msg=audit(1325525137.354:63): arch=c000003e syscall=59 success=yes exit=0 a0=2506d48 a1=2500308 a2=249a008 a3=7fffe4130170 items=2 ppid=30147 pid=32431 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts2 ses=4294967295 comm="ls" exe="/bin/ls" key="ls"
type=EXECVE msg=audit(1325525137.354:63): argc=5 a0="ls" a1="--color=auto" a2="--group-directories-first" a3="--time-style=long-iso" a4="--ignore-backups"
type=CWD msg=audit(1325525137.354:63):  cwd="/home/enzotib"
type=PATH msg=audit(1325525137.354:63): item=0 name="/bin/ls" inode=389459 dev=08:02 mode=0100755 ouid=0 ogid=0 rdev=00:00
type=PATH msg=audit(1325525137.354:63): item=1 name=(null) inode=395716 dev=08:02 mode=0100755 ouid=0 ogid=0 rdev=00:00

where on the last lines you could see the ls invocation a run for test. Ok, the log file is not so simple to read, but with some text processing you can get the output you want.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .