Am 12:39 2003-05-14 -0500 hat Nathan E Norman geschrieben: > >On Wed, May 14, 2003 at 06:26:16PM +0100, Michael Parkinson wrote: >> [ I wrote ] >> > On Wed, May 14, 2003 at 03:33:36PM +0100, Michael Parkinson wrote: >> > > Dear All,
>Well, where you log to is up to you, but that wasn't my question :-) > >What activity are you trying to log? Activity on machines (user a ran >this, consumed this much cpu time, etc.) or activity on the network >(user b accessed this site, consumed this much bandwidth, etc.) ? > >The latter is far more difficult: how do you know that a packet was >caused by user b's activity? Where is the problem ??? I will asume, that user login only on the machine and not remotely... Ther is a Debian-Package which log the users login-time this can you redirect to a logging server. The login is loged with the machinename/IP. Then, you log the traffic with ipac and write a script, which compare the logfiles by time... Now you have the users TCP/IP activity logged. I do this in my Secure-Network have a nice day Michelle
