I've just created a Windows Server 2012 Domain and I inserted an ubuntu 14.04LTS laptop in the domain, which is responsible for file exchanging with a USB between the domain users. How can I keep a record of the domain's users logins, and their actions (e.g., transferred 2 files from FOLDER to removable disk)?

Is there any way that I can keep record of which files were transferred between a USB and my Pc for each user who logs on my Ubuntu?


Logins are traceable via last and lastb command, actions requiring sudo privilege are traceable via /var/log/auth.log , but anything that is a normal , unprivileged action is untraceable , at least if it's done via GUI. Command line is traceable via user's history file, if and only if they've not fiddled with history file. You could spawn script command to be logging the whole command-line session to a file other than history, but that is also not a bullet proof solution.

Essentially , the answer is you can trace logins , but not the unprivileged actions and only if logs were not fiddled with

  • Well - for command-line actions psacct might be used, for example. For GUI activity probably rather some bigger tools, recording sessions as video should be used. Not sure if there are good, free options for that. Some reaserch might help. – Jacek Apr 8 '16 at 15:43
  • @Jacek recording sessions isn't that good of an idea, especially if you multiply gigabytes of recorded sessions times lots of users. – Sergiy Kolodyazhnyy Apr 8 '16 at 16:20
  • May be, or may be not - but anyway - may be still simply required for audit purposes. Storage and retention periods are another subject, of course. – Jacek Apr 10 '16 at 18:06
  • So there is not any way of checking USB transfer logs ..? I – Lenos Adamou Apr 11 '16 at 6:07
  • @LenosAdamou I am afraid there's no way to have transfer logs. You could have a udev rule that will run a script to record username and device that was connected , date and time, but that's about it. There's process accounting solutions like this, bt i don't know how well they work for file transfer done over filemanager. The only solution I see is that you'd have to have some form of app or at least a script for filemanager that will do recording for you – Sergiy Kolodyazhnyy Apr 11 '16 at 6:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.