Monitor User Activity with psacct
psacct :- psacct is a open-source monitoring tool.
-
ac command is used to check statistics of user logins/logouts (connect time) in hours.
-
By using lastcomm command we can see the information of previously executed commands of any perticular user.
-
accton commands is used to turn on/off process for accounting.
-
sa command summarizes information of previously executed commands.
-
last and lastb commands show listing of last logged in users
Installation on Centos, Fedora and Redhat.
# yum install psacct
Start the service of psacct. # /etc/init.d/psacct start Starting process accounting: [ OK ] Check Status # /etc/init.d/psacct status Process accounting is enabled.
Installation on Ubuntu / Debian
#apt-get install acct
Some Examples:-
ac command is used to Check statistics of user logins/logouts (connect time) in hours
[root@linux ~]# ac
total 634.77
Command “ac -d” is used to prints out the total login time in hours by day-wise.
[root@linux ~]# ac -d
May 11 total 44.37
May 13 total 105.92
May 14 total 62.57
May 15 total 65.62
May 16 total 60.11
May 17 total 61.74
May 20 total 157.41
May 21 total 50.13
Today total 27.10
Display Day-Wise Logn Time of User
Blow example for user sahil and root user
[root@linux ~]# ac -d sahil
May 21 total 0.01
[root@linux ~]# ac -d root
May 11 total 44.37
May 13 total 105.92
May 14 total 62.57
May 15 total 65.62
May 16 total 60.11
May 17 total 61.74
May 20 total 157.41
May 21 total 50.12
Today total 27.54
[root@linux ~]#
“ac -p” command is used to checked the total login time of each user in hours.
[root@linux ~]# ac -p
sahil 0.01
root 635.02
total 635.02
Check All Account Activity Information
[root@linux ~]# sa
8639 1335211.89re 2.14cp 1735k
8 147289.50re 1.35cp 14842k npviewer.bin
32 0.23re 0.14cp 2992k awstats.pl
51 280496.95re 0.12cp 3947k ***other*
2 2.02re 0.11cp 866k prelink
1349 0.26re 0.08cp 2995k ld-linux.so.2
32 0.34re 0.07cp 2103k perl
3 7.36re 0.07cp 8270 14842k k notification-da
3 0.30re 0.06cp 9029k sa-update
7 645442.22re 0.05cp 8536k amavisd*
6 1.31re 0.03cp 5080k amavisd
213 0.09re 0.02cp 689k ps
65 2.02re 0.01cp 662k awk
2 34.81re 0.01cp 908k mount
4 0.07re 0.01cp 1221k abrt-hook-ccpp
358 252028.97re 0.00cp 584k ping
103 0.27re 0.00cp 2447k sshd
5 0.00re 0.00cp 525k bzip2
7 0.06re 0.00cp 4696k gnome-screensav
45 0.02re 0.00cp 654k find
5 0.03re 0.00cp 2028k mysqldump
2 0.00re 0.00cp 674k pidof
354 21.24re 0.00cp 1111k check_ping
103 0.19re 0.00cp 1988k check_http
9 4.84re 0.00cp 747k run-parts
5 0.34re 0.00cp 3278k sendmail
2 9851.56re 0.00cp 666k udevd*
2 0.02re 0.00cp 659k logrotate
1190 1.03re 0.00cp 752k sh
1179 22.20re 0.00cp 4498k nagios*
1113 0.07re 0.00cp 594k gzip
1113 0.07re 0.00cp 519k iconv
206 0.16re 0.00cp 1060k check_procs
104 0.41re 0.00cp 2447k sshd*
103 0.31re 0.00cp 1108k check_ssh
103 0.05re 0.00cp 1054k check_users
103 0.05re 0.00cp 1097k check_swap
103 0.04re 0.00cp 1059k check_disk
102 0.05re 0.00cp 1054k check_load
53 0.01re 0.00cp 590k basename
48 0.01re 0.00cp 1267k npviewer*
43 0.01re 0.00cp 500k logger
35 1.21re 0.00cp 1484k crond*
33 0.00re 0.00cp 509k tmpwatch
25 0.07re 0.00cp 770k udisks-helper-a
20 0.00re 0.00cp 1016k uname
18 0.01re 0.00cp 860k grep
13 0.01re 0.00cp 547k date
Note:-
Where 147289.50re is a “real time” as per wall clock minutes
1.35cp is a sum of system/user time in cpu minutes
14842k is a cpu-time averaged core usage, i.e. 1k units
command name npviewer.bin
Check information of individual user :-
[root@linux ~]# sa -u
root 0.00 cpu 466k mem accton
root 0.01 cpu 571k mem logrotate
root 0.00 cpu 747k mem logrotate
root 0.00 cpu 637k mem awk
root 0.00 cpu 503k mem basename
root 0.00 cpu 500k mem logger
root 0.00 cpu 503k mem basename
root 0.00 cpu 500k mem logger
root 0.00 cpu 556k mem sed
root 0.00 cpu 747k mem makewhatis.cron *
root 0.00 cpu 747k mem makewhatis.cron *
root 0.00 cpu 546k mem touch
root 0.00 cpu 654k mem find
root 0.00 cpu 570k mem grep
root 0.00 cpu 503k mem basename
root 0.00 cpu 542k mem mktemp
root 0.00 cpu 638k mem awk
root 0.00 cpu 748k mem makewhatis *
root 0.00 cpu 556k mem sed
root 0.00 cpu 747k mem makewhatis *
root 0.00 cpu 552k mem man
root 0.00 cpu 748k mem makewhatis *
root 0.00 cpu 510k mem tr
root 0.00 cpu 747k mem makewhatis *
root 0.00 cpu 748k mem makewhatis *
root 0.00 cpu 510k mem tr
Check Number of Process
[root@linux ~]# sa -m
8639 1335211.89re 2.14cp 1735k
root 5581 689703.16re 1.98cp 1354k
amavis 11 645442.55re 0.09cp 7714k
clamav 1 0.06re 0.06cp 1042k
nagios 2926 65.49re 0.02cp 2405k
sshd 104 0.41re 0.00cp 2447k
policyd 16 0.23re 0.00cp 3541k
Important :_
Checked Last Executed Commands of User
The ‘latcomm‘ command is used to search and display previously executed user commands information. You can also search commands of individual usernames. For example, we see commands of user (root).
[root@linux ~]# lastcomm root
uname root __ 0.00 secs Wed May 22 11:23
npviewer.bin S root __ 15.36 secs Wed May 22 10:48
sshd S root __ 0.00 secs Wed May 22 11:21
sshd S root __ 0.01 secs Wed May 22 11:16
notification-da root __ 0.04 secs Wed May 22 11:11
dbus-daemon F X root __ 0.00 secs Wed May 22 11:11
udisks-helper-a S root __ 0.00 secs Wed May 22 11:11
udisks-helper-a S root __ 0.00 secs Wed May 22 11:11
sshd S root __ 0.01 secs Wed May 22 11:11
sshd S root __ 0.01 secs Wed May 22 11:06
sshd S root __ 0.00 secs Wed May 22 11:01
crond SF root __ 0.00 secs Wed May 22 11:01
run-parts root __ 0.00 secs Wed May 22 11:01
logger root __ 0.00 secs Wed May 22 11:01
basename root __ 0.00 secs Wed May 22 11:01
awk root __ 0.00 secs Wed May 22 11:01
0anacron root __ 0.00 secs Wed May 22 11:01
date root __ 0.00 secs Wed May 22 11:01
cat root __ 0.00 secs Wed May 22 11:01
logger root __ 0.00 secs Wed May 22 11:01
lastcomm command you will be able to view individual use of an each commands.
Example for df, ls and mkdir command.
[root@linux ~]# lastcomm df
df root pts/8 0.00 secs Wed May 22 09:10
[root@linux ~]# lastcomm ls
ls root __ 0.00 secs Wed May 22 03:09
[root@linux ~]# lastcomm mkdir
mkdir S root __ 0.00 secs Wed May 22 03:30
[root@linux ~]#
Enjoy Linux-Ing 🙂 🙂 🙂