How to Monitor User Activity with psacct or acct Tools

If you have any questions or problems regarding this article and want help within 24 Hours? Ask Now

Ravi Saive

Simple Word a Computer Geek and Linux Guru who loves to share tricks and tips on Internet. Most Of My Servers runs on Open Source Platform called Linux.

Your name can also be listed here. Got a tip? Submit it here to become an TecMint author.

Receive Your Free Complimentary eBook NOW! -

Download Free Linux eBooks

Advanced Bash-Scripting Guide
Linux Bible
A Newbie's Getting Started Guide to Linux
Ubuntu Linux Toolbox: 1000+ Commands

You may also like...

9 Responses

  1. How to join your community…..what is the process of joing community…please tell me…
    Thank you

  2. pratheesh says:

    thanks for such useful and Excellent article! Keep going :)

    how can we know how many task’s(process) are hold by the swap when ram is full.

  3. Manoj says:

    Ravi, thanks for such useful and Excellent article! Keep going :)

  4. bruce says:

    thanks, i am using this tools these days , but i found that the information accounted by psacct will reset several days once. do you know how to change it because i want to monitor my computer for a long time. thanks again.

  5. Ken Hall says:

    It is possible to give users full sudo access without allowing sudo su… That way all commands will be logged.

    Cmnd_Alias SU = /bin/su root, /bin/su – root

    Cmnd_Alias FORBIDDEN = /bin/bash, /bin/ksh, /bin/ksh93, /bin/sh, /bin/csh, /bin/tcsh, /bin/zsh, /usr/sbin/pwconv, /usr/sbin/visudo, /usr/bin/crontab


  6. Mohit Kumar says:

    Its good article and very useful. But there are number of sysadmins handling lots of server.

    We have done as below:-

    1- Disabled first level root access.
    2- created individual login for users with sudo access.

    User has to login with his individual login ID and he can switch to root prompt through
    # sudo su –

    Now user becomes root and he has all privileges.

    How we can monitor this?

    While we can log all that command, which has been fired with sudo. But after the switching to root, not able to identify.

    A sudo user can not switch to root. Is this possible??

    • Ravi Saive says:

      That’s not possible, if a user knows the root password he will able to login and run commands. But if you would like to trace those commands with date and time of execution, you need to use history command.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

Join Over 80000+ Linux Users
  1. 52882
  2. 2763
  3. 18,639

Enter your email to get latest Linux Howto's