also sprach [EMAIL PROTECTED] <[EMAIL PROTECTED]> [2002.01.13.0016 +0100]: > I've got a user who I think is screwing up my server. How do I set up > a log to "log" everything this person does? And can I watch it real > time?
compile your kernel with accounting turned on (does the debian stock kernel have that? it should...) and install the 'acct' package. /etc/init.d/acct start and you can use `lastcomm theuser` to get a list of all commands executed by that user. it's thorough, but it's not as illegal as ttysnoop... -- martin; (greetings from the heart of the sun.) \____ echo mailto: !#^."<*>"|tr "<*> mailto:"; [EMAIL PROTECTED] i need not suffer in silence while i can still moan, whimper and complain.
pgp5HLPsJryzv.pgp
Description: PGP signature
